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THE COURT: We are back on the record, the 
members of the jury are not present. It's my 
understanding you still, other than the PowerPoint, other 
exhibits that needed to be introduced? 

MR. JENNINGS: What we have pending. Judge, is 
the offer of the components of the PowerPoint of Mr. 
Stopschinski and Mr. Walker. 

THE COURT: Okay. 

THE COURT: What there anything else? I'm not 
quite ready to talk about those. 

MR. JENNINGS: If it's helpful. Judge, we can 
cull that and just offer the original photographs. 

THE COURT: Let me show you what I have looked 
at as far -- off the record. 

(Discussion had off the record.) 

THE COURT: We are back on the record, members 
of the jury are present, counsel and their clients. 

Dr. Young is still on the stand. I'll remind you are 
still under oath. And, Mr. Baker, you may begin your 
cross-examination. 

MR. BAKER: Thank you. Your Honor. 

CROSS EXAMINATION 

BY MR. BAKER: 

Q. Good afternoon. Dr. Young. 

A. Good afternoon. 
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1 Q. You and I met back in August? 

2 A. Yes. 

3 Q. I came out to Torrance, California and took your 

4 deposition? 

5 A. You did. 

6 Q. And at that time you went through the opinions that 

7 you have reached in this case with me at that time? 

8 A. Yes. 

9 Q. And you ended today with your last slide you said 

10 that it was your conclusion that this wreck was the 

11 result of driver error? 

12 A. Yes. 

13 Q. Were you aware that Akio Toyoda, the CEO and 

14 president of Toyota Motor Corporation under oath told the 

15 US Congress that from that point forward and I'm going to 

16 quote him, I will make sure that we will never ever blame 

17 the customers going forward. Were aware that he made 

18 that statement? 

19 A. I had heard statements of such, but I don't know 

20 that I have actually looked at that specifically. 

21 Q. So the lawyers that you have been employed by here 

22 to work in this case, they didn't tell you Mr. Toyoda 

23 said that to Congress under oath? 

24 A. I'm sorry, can you say that again? 

25 Q. The lawyers that hired you in this case, they didn't 
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1 tell you that Mr. Toyoda said that under oath to 

2 Congress? 

3 A. No. 

4 Q. Because what you said is, you are blaming the 

5 driver, correct? 

6 A. No. 

7 MR. BIBB: Objection, Your Honor, misstates the 

8 testimony. 

9 THE COURT: Overruled. 

10 THE WITNESS: No. 

11 Q. (BY MR. BAKER) Driver error, that's what it says? 

12 A. Yes. 

13 Q. You also mentioned in your qualifications that you 

14 work for Exponent, that's got employees and offices in 

15 multiple cities? 

16 A. Yes. 

17 Q. You also mentioned that Exponent does work for the 

18 US Government? 

19 A. Yes. 

20 Q. And I think comment was that the government hires 

21 you from time to time to help them answer questions? 

22 A. Yes. 

23 Q. Were you aware that on February 22, 2010 that the 

24 Chairman for the House Committee on Energy And Commerce 

25 wrote a letter to James Lentz, the president of Toyota 
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1 USA, and offered criticisms of Exponent's work in 

2 investigating Toyota UA events, were aware of that? 

3 A. Yes, but not specifically. 

4 Q. You also outlined for us several reports and studies 

5 related to a finding that typically it's not a vehicle 

6 based problem with UA's, but more than often not is 

7 driver pedal misapplication? 

8 A. Yes. 

9 Q. Did any of those studies consider the fact that with 

10 respect to the Toyota Camry that as early as 2004 there 

11 was 400 percent increase in the number of UA claims made 

12 with respect to the Camrys with electric throttle 

13 control? 

14 A. I'm sorry. I missed the first part. Say that 

15 again. 

16 Q. Did any of these reports consider that fact, that 

17 there had been a 400 percent increase for Camrys for UA 

18 claims once electric throttle control had been 

19 introduced? 

20 MR. BIBB: Objection, misstates what the data 

21 shows. 

22 THE COURT: Overruled. You may answer. 

23 THE WITNESS: I haven't really considered 

24 claims as a part of my analysis, but I am aware that 

25 there have been some agencies that have looked at what 
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some people call VOQs or customer complaints. 


2 Q. But you yourself have not considered those claims by 

3 other people who say they've experienced an unintended 

4 acceleration for your analysis in his case, is that 

5 right? 

6 A. I haven't analyzed that, no. I've relied on the 

7 scientific literature of published data. 

8 Q. And that was my question to you originally. Did the 

9 published data that you're relying on consider 

10 specifically with the Toyota Camry that there had been a 

11 400 percent increase in UA claims before — or at or 

12 during 2004 or before? 

13 MR. BIBB: Objection, Your Honor. 

14 THE COURT: Overruled. 

15 THE WITNESS: Well, again, I can only speak to 

16 the analysis that have been published in, for example, 

17 the NHTSA reports that I reviewed — 

18 THE COURT: Would you pull that microphone just 

19 a little bit closer? 

20 THE WITNESS: Sure, I'm sorry. That indicate 

21 there are claims for all vehicles of all types, but I've 

22 not looked specifically at any particular claims with 

23 Toyotas. 

24 Q. (BY MR. BAKER) So it true that in terms of the 

25 research papers that you looked at and relied on and 
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1 talked about here, you do not know whether those papers 

2 considered the fact that Camry has experienced a 400 

3 percent increase in UA claims? 

4 A. Again, I don't know the exact nature of the 

5 complaints. I believe that in 2012 the NHTSA analysis 

6 did look at some complaints. 

7 Q. Did they look at that 400 percent increase is my 

8 question. Do you know? Either you do or you don't? 

9 A I don't recall. 

10 Q. In terms of the some of the NHTSA papers and 

11 documents that you showed us indicating there is no 

12 vehicle based problem, do you know whether those people 

13 looking at that issue were aware that Toyota failed to 

14 tell NASA, who investigated the Camry, that it didn't 

15 have EDAC, it didn't have extra memory that would help 

16 prevent UA from occurring? Did you -- did they consider 

17 that? 

18 A. I can't tell you what they knew or didn't know. 

19 Q. Did they consider the fact that when the government 

20 investigated the Camrys that Toyota did not provide 

21 source code to the government for the monitor CPU that's 

22 involved in this vehicle? 

23 A. Again, I can't tell you, I don't know. 

24 Q. In the study that you mentioned that there is no 

25 vehicle based problem with causing UAs, did those papers 
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1 consider the fact that Toyota actually went to NHTSA and 

2 agreed that there were defects related to the Camry's and 

3 other Toyota vehicles involving the placement of all 

4 weather mats and sticky pedals that were causing UAs? 

5 A. I don't -- I don't recall. I know that there were 

6 some issues associated with that but I can't tell you the 

7 specifics of it. 

8 Q. So in terms of a vehicle based cause of UA, you 

9 understand that Toyota has at least admitted that sticky 

10 pedals and sometimes an all weather floor mats can be a 

11 cause of UA? 

12 A. I can't really recall the exact statement from 

13 Toyota with regards to those issues. 

14 Q. But assuming that they have, that would be a vehicle 

15 based defect causing UA, not a driver based issue, 

16 correct? 

17 A. If that was an issue, sure. 

18 Q. In your analysis did you consider the fact that 

19 Mr. Lentz told Congress that if you take out all weather 

20 mats and you take out sticky pedals, that Toyota has been 

21 unable to address 70 percent of the UA claims that are 

22 out there in terms of their cause? Were you aware of 

23 that? 

24 MR. BIBB: Objection, Your Honor, misstates the 

25 testimony. 
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1 THE COURT: Overruled. 

2 THE WITNESS: I haven't analyzed Mr. Lentz's 

3 testimony. 

4 Q. (BY MR. BAKER) In this case during the deposition I 

5 believe you told me that you relied on the accident 

6 reconstruction in forming your opinion, is that correct? 

7 A. Yes. 

8 Q. And you would have also relied on and I think you 

9 told me you looked at a number of depositions in this 

10 case as part of your analysis? 

11 A. Yes. 

12 Q. Let me go back to your studies before I do this. 

13 the studies that you talked about and relied on in this 

14 case, have they concluded that 100 percent of all claimed 

15 UA events are driver error? 

16 A. Again, I've not really studied the claims. What we 

17 have used as our data source are accidents that have been 

18 reported to the police. So I understand there's a claims 

19 database where people can call and said they had a 

20 problem with their vehicle, but what I've used is the 

21 published literature that looks at accidents that are 

22 reported by the police, so it's a different database 

23 altogether. 

24 Q. But you presented papers to us here and you've 

25 offered the opinion that more than not it's driver error. 
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1 pedal misapplication or inattention that results in these 

2 events, correct? 

3 A. In these accidents, yes. 

4 Q. In these accidents do these studies say that 100 

5 percent of the accidents are caused by driver inattention 

6 or pedal misapplication? 

7 A. Again, all I can say is the data from accidents 

8 shows the vast majority of accidents are associated with 

9 driver error, not 100 percent, but vast majority for 

10 sure, maybe 90 percent. Sometimes environment effects, 

11 sometimes vehicle effects. Recall the first very slide 

12 that showed with the data had about 90 percent of the 

13 accidents involved with driver error. So not all, no, 

14 not 100 percent. 

15 Q. So there can be UA events that are actually vehicle 

16 based unintended acceleration events in the world, 

17 correct? 

18 A. I suppose, sure. 

19 Q. Going back to the things you reviewed in this case. 

20 You talked about considering the facts of the case. Did 

21 you consider the fact that Ms. Western testified before 

22 this jury and in deposition that I know you reviewed 

23 because we talked about it, that the hand brake had been 

24 pulled in the case because they couldn't get the vehicle 

25 stopped, did you consider that? 
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1 A. Yes. 

2 Q. Did you consider the testimony of Charles Schwarz 

3 where he said his wife called from the wreck and said we 

4 couldn't stop the car, did you consider that? 

5 A. Yes. 

6 Q. Did you consider the testimony of Mr. Allen, who was 

7 one of the first people on the scene who talked to 

8 Ms. Schwarz and was told essentially the same thing, we 

9 could not get the car stopped, we did everything we 

10 could. Did you consider that? 

11 A. Yes, I considered Mr. Allen's testimony. 

12 Q. We also heard from Star Caudle, one of the EMTs in 

13 the case, who said Mrs. Schwarz told her the same thing, 

14 we could not get this vehicle stopped, we were trying to 

15 stop it, did you consider that? 

16 A. Yes. 

17 Q. And then finally we had Mr. Smith who testified 

18 today. Were you in the courtroom when he testified? 

19 A. I was. 

20 Q. And he also said Ms. Schwarz told him the same 

21 thing, did you consider all that testimony? 

22 A. I did. 

23 Q. And you just considered that they were mistaken? 

24 A. Well, I considered all the evidence. 

25 Q. But in terms of what they said happened and what 
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1 they were told, they must have been mistaken, correct? 

2 A. Well, not necessarily. As I understand it we have a 

3 situation in which Ms. Bookout is traveling on the road, 

4 goes on the off ramp and can't stop her vehicle. So I 

5 don't think that is inconsistent with the fact that she 

6 is unable to stop it. Certainly that's her perception, 

7 that is the discussions he had with Mrs. Schwarz. 

8 Q. But the discussion Ms. Schwarz had with Ms. Bookout 

9 and then relayed to all these people is consistent, we 

10 tried to stop the vehicle but it would not stop, are they 

11 wrong about that? 

12 A. Well, that's -- 

13 Q. It was not a UA event, were they wrong about it? 

14 A. I'm -- I'm of the opinion that in this particular 

15 accident there was a situation in which Mrs. Bookout 

16 believed she is trying to stop the vehicle by hitting the 

17 brake, but is not. So she is attempting to stop the 

18 vehicle on a pedal that she believes is the brake, but 

19 it's not, it's the accelerator. 

20 Q. And you also told me in the deposition that you 

21 thought the skid mark -- you offered me the opinion at 

22 your deposition that the single long mark, the 150 foot 

23 skid mark you believed was made by the service brake? 

24 A. Yes, based on the scientific literature that 

25 discusses how drivers respond to emergency situations and 
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1 they become panicked or hypervigilant and they have what 

2 we call perceptional narrowing in which they begin to 

3 steer and try to control the vehicle, not consider other 

4 secondary activities to stop the vehicle like shifting 

5 the gear shift selector, or the turning the vehicle off 

6 or pulling the hand brake. 

7 Q. And you told me at that time that even though 

8 Ms. Bookout testified that she believed she was pumping 

9 the brake, you told me that your literature told you most 

10 times people don't pump brakes, isn't that right? 

11 A. That's absolutely the case. In fact, the scientific 

12 literature that I've reviewed which I looks at a vast 

13 array of emergency related situations indicates that 

14 drivers use a ballistic forceful action onto the brake 

15 pedal, and then use what I call sensory feedback to 

16 determine how the vehicle's traveling, and then modulate 

17 it. So it's not a pumping action where you pump the 

18 brakes, take your foot off, pump the brakes hard, pump 

19 the brakes. 

20 Q. You said it's ballistic, I mean, it's a hard press 

21 to the brake? 

22 A. Yes, it's -- 

23 Q. It' s a stomp? 

24 A. Well, a ballistic action is one in which is made 

25 without sensory feedback. It's planned in advance. You 
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1 move to the brake, it's rapid. 

2 Q. And hard? 

3 A. Relatively hard, not always, and it's not full 

4 force. 

5 Q. But you told me in this case you believed it was 

6 unlikely that Ms. Bookout pumped the brake? 

7 A. Yes. 

8 Q. And we've talked a little bit about pedal 

9 misapplication, and you talked about it yourself, 

10 correct? 

11 A. Yes. 

12 Q. If she didn't pump the brake, then she would not 

13 have pumped the accelerator, would she? 

14 A. Well, that's her testimony is that she pumped the -- 

15 what she thought was the brake. 

16 Q. I didn't ask about hers, I asked about your opinion. 

17 You told me she did not pump the brake? 

18 A. Yes. 

19 Q. And if it's your opinion she didn't pump the brakes, 

20 then coincidentally she couldn't have pumped the 

21 accelerator under your opinion, correct? 

22 A. No, that's not quite what I said. 

23 Q. So you're saying she didn't pump the brakes but she 

24 could have pumped the accelerator? 

25 A. Yes. 
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Q. And looking at the skid marks, the 150 foot skid 
mark, you agree with me at your deposition that any 
pumping that would have occurred or any misapplication of 
the pedal would have occurred prior to the creation of 
the skid mark, correct? 

A. Well, again, I'm not a brake an expert, but 
certainly had she applied the brake sooner, is that what 
you're asking me? 

Q. No, sir. Let me ask it a different way. When we 
start leaving the skid mark, she's on the brake? 

A. Yes. 

Q. She's not on the accelerator? 

A. That's correct. 

Q. So if there was a pedal misapplication, as you've 
suggested, it occurred back upstream? 

A. Well, certainly in terms of its actual contact, 
that's to say the foot with the brake, but the timely 
nature as we talked about earlier, is an indicator of a 
misappropriate behavioral pattern. 

Q. I appreciate that. I appreciate your opinion, but 
that wasn't exactly my question. At the point we're 
making the skid mark she is on the brake, correct? 

A. Yes. 

Q. So any pedal misapplication occurred before that 
time? 
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A. Well, again, best I can say is when she is on the 
brake, it's too late to stop, so. 

Q. And I didn't ask you -- 

A. But that's a misapplication of the pedals. 

Q. We'll get to that. But my point is, when she starts 
leaving that skid mark right here, she is on the brake, 
correct ? 

A. Yes. 

Q. So any pedal misapplication that you're talking 
about would have occurred further up the road, not past 
this point, correct? 

A. Well, again, she's on the brake as you say, so the 
timing of it is what I'm having a difficult issue with, 
is to say that's not indicative of an error when it is 
because she is applying the brake too late. 

Q. That wasn't my question at all. I simply asked you 
if any pedal misapplication that you say occurred 
happened before this point up here, yes or no? 

A. Well, again,'s is the only way I can answer that. I 
don't know how to answer it in a different way. I'm 
basically saying, as I have, it's a delayed response so, 
that in my mind is a failure to control the vehicle 
speed, which is a pedal misapplication because she should 
have been on that earlier. 

Q. I understand. For some reason you're not following 
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1 me. The pedal misapplication where she may have pumped 

2 the accelerator is a pedal misapplication, right? 

3 A. That is one possibility, absolutely. 

4 Q. If that occurred, it occurred before she pressed the 

5 brake at this point and started leaving the skid mark, 

6 right? 

7 A. Yes. 

8 Q. That's all I'm asking. 

9 A. Sorry, I thought you were asking something else. 

10 Q. It wasn't a trick question. At the time of your 

11 deposition in terms of accident reconstruction, you told 

12 me it was your understanding that Ms. Bookout was 

13 traveling at 60 miles an hour at the top of the ramp 

14 based on your review of Mr. McCort's reconstruction and 

15 your discussion of Toyota's reconstruction with Mr. 

16 Stopschinski. Correct? 

17 A. Well, as you recall, I didn't have a chance really 

18 to read their deposition transcripts in their entirety, 

19 but that is correct I did base that on Mr. McCort's 

20 analysis primarily. 

21 Q. And what Mr. Stopschinski told you, correct? 

22 A. As far as I can recall, yes, but primarily Mr.'s 

23 McCort analysis. 

24 Q. But that's not what you said? 

25 A. I think it is what I said. 
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1 Q. You want to look page 60 of your deposition. Do you 

2 have page 60? 

3 A. I do. 

4 Q. I'm looking at line 12 and I asked you "And what 

5 speeds are you assuming for your evaluation?" And your 

6 answer, "Well, it's my understanding from the materials 

7 that I've been provided and my discussions with Mr. 

8 Stopschinski, that Ms. Bookout was traveling likely at 

9 the speed limit because she said that's typically what 

10 she would travel on the freeway, and then as she took the 

11 off ramp she slowed down, and as I understand it from Mr. 

12 McCort, she was traveling about 40 miles an hour" -- 

13 MR. BIBB: Excuse me, that is 60. 

14 Q. (BY MR. BAKER) I'm sorry, you're right. "60 miles 

15 an hour at the top of the ramp and then 40 miles at the 

16 start of the skid, which was approximately 150 feet from 

17 the point of rest." 

18 Did I read that correctly? 

19 A. Yes, well except for the 40. 

20 Q. Except for my mess up. So based on what you told 

21 me, your understanding of the reconstruction came from 

22 two sources, Mr. McCort's deposition and discussions you 

23 had with Mr. Stopschinski? 

24 A. Well, that's actually fairly correct. And as you 

25 had mentioned in my deposition, those values 60 miles an 
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hour and 40 miles an hour came from Mr. McCort, which as 
I had said I understand it from Mr. McCort she was 
traveling about 60 miles an hour. 

Q. Flip the page for me, page 61. We continue the 
discussion. At line 6 I said, "Do these speeds coincide 
with the general information provided to you by the 
defendant's accident reconstructionist?" 

What was your answer? 

A. Yes. 

Q. So at that time you understood from Mr. Stopschinski 
that at the time the skid mark is being made she was 
traveling about 40 miles an hour, correct? 

A. No, generally I said yes, but I don't have a 
specific value as Mr. Stopschinski's deposition hadn't 
been taken yet, so I didn't have a specific value in mind 
from him. 

Q. But you talked to him, didn't you? 

A. Well, I spoke to him in general. I didn't ask him 
specific questions about the specific values that you've 
been asking me about in particular. 

Q. But you told me in your deposition you did? 

A. I did not speak to him specifically about the values 
that you have asked me about in terms of 60 miles an hour 
and 40 miles an hour specifically. 

Q. So you're telling me at the time you offered your 
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1 opinions in this case where you needed to rely on 

2 accident reconstructionists, that Mr. Stopschinski had 

3 not completed his reconstruction? 

4 A. I don't think he had the values, as I understand 

5 them, calculated at the point at which I had talked with 

6 him. 

7 Q. And you understand that your opinion were 

8 supplemented as were those of Mr. Stopschinski and his 

9 opinions were provided to us before your depositions were 

10 taken? 

11 A. Supplemented. I'm not sure what you mean. 

12 Q. Let me ask it a different way. The opinions you're 

13 going to give in this case were given to you by the 

14 lawyers in your deposition? 

15 A Yes. 

16 Q. And that included the opinions of Mr. Stopschinski 

17 was going to have for this case? 

18 A. Yes. 

19 Q. So even though it was given to us before the 

20 deposition, you're now telling us that his reconstruction 

21 was preliminary? 

22 A. Well, as far as I understand it, I didn't do the 

23 accident reconstruction. That's really a question for 

24 Mr. Stopschinski. 

25 Q. But you relied on it? 
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1 A. Yeah, I relied on what he told me and what he had 

2 written in that document in terms of a general 

3 understanding. 

4 Q. And then you also told me in terms of reviewing Mr. 

5 McCort's deposition that you were not critical and did 

6 not disagree with anything about his analysis, isn't that 

7 true? 

8 A. Again, I'm not an accident reconstructionist, I'm 

9 not going to have any criticism of the values and how he 

10 determined them. 

11 Q. You've also in offering your opinions in this case 

12 told me what a timely brake application would have been 

13 by Ms. Bookout, do you recall that? 

14 A. Yes. 

15 Q. And in terms of your opinion about the timely brake 

16 application, you defined it as follows, quote, in a way 

17 in which she would be able to either stop the vehicle 

18 from colliding with the ditch or significantly reducing 

19 the impact speed at her final speed, correct? 

20 A. Yes. 

21 Q. And you were here for Mr. Walker's testimony, 

22 correct? 

23 A. Part of it. 

24 Q. Going back to the 150 skid mark that we have up here 

25 that was left by the Bookout vehicle, and I don't know if 
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24 

you were here for the discussion that there is actually, 
adding up the trooper's measurements, approximately 131 
feet of paved surface that the vehicle left a mark on, 
were you here for that? 

A. I think so. 

Q. All right. Mr. Walker ran some tests with a vehicle 
traveling at 50 miles an hour when he applied the brake. 
He also let off the throttle. Were you here for that 
discussion? 

A. I sort of picked that up, but I sort of like come in 
the middle of the dance. 

Q. I understand. And based on what you told me 
earlier, when we start leaving this skid mark back here, 
Ms. Bookout is on her brake, applying the brake, trying 
to stop the vehicle? 

A. Yes. 

Q. She would not be on the throttle as you understand 
it? 

A. At the skid mark, that's correct. 

Q. So, under the test conditions that Mr. Walker had, 
he had a vehicle stopped at 133 feet with no open 
throttle and brake application, and then a second test he 
stopped the vehicle in 110 feet with no throttle and 
brake application. Are you with me so far? 

A. I am. 
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1 Q. So, if we go back to our police officer's diagram, 

2 we're at the point where we start leaving a skid mark, if 

3 we use the test Mr. Walker did, this vehicle should be 

4 able to stop by the time it reaches the end of the 

5 asphalt and before it hits the ditch, correct? 

6 A. I really can't tell you what those tests tell us in 

7 terms of that particular question because I don't know 

8 the parameters for which Mr. Walker ran his tests. I see 

9 the numbers that you have but I can't really give an 

10 informed opinion because I don't know enough about the 

11 test that he ran and the conditions under which they were 

12 run. 

13 Q. Let me help you out and do it in hypothetical form. 

14 We've got a vehicle up here that's capable of stopping in 

15 a distance of maximum of 133 feet with no throttle and no 

16 brake. You'll agree with me it would stop before it hit 

17 the ditch? 

18 A. Well, that value is less than 150, yes, it is. 

19 Q. So it would stop before it hit the ditch? 

20 A. Well, again that is 150 is the value and 133 is the 

21 value on that test, then if you want to assume those two 

22 things sure, 133 is shorter than 150. 

23 Q. So then it would fit your definition of a timely 

24 brake application if we can stop it in 133 feet, correct? 

25 A. From that point, sure, if there's a vehicle stopped 
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1 before the ditch, that would be timely. 

2 Q. Were you aware that Mr. Arora also ran some vehicle 

3 tests at 45 miles an hour? 

4 A. No. 

5 Q. Assume for me he has, assume for me that Mr. Arora 

6 or anybody for that matter ran several tests with an open 

7 throttle -- excuse me, a closed throttle and a brake 

8 application at 45 miles an hour. And in each of those 

9 instances with 60 pounds of brake force they were able to 

10 stop this vehicle in 100 feet or less. Can you assume 

11 that for me? 

12 A. Sure. 

13 Q. 100 feet on our diagram would prevent us from 

14 getting to the ditch, correct? 

15 A. Based on the numbers. 100 is less than 150, 

16 absolutely. 

17 Q. And that would fit your definition of a timely 

18 application, correct? 

19 A. Yes. If there was a stop prior to the ditch, 

20 absolutely. 

21 Q. Assuming Mr. Walker and Mr. Arora did those tests 

22 and showed that the vehicle can stop in 133 feet or less, 

23 can you agree with me that simply applying the brake when 

24 Ms. Bookout did would be a timely application of the 

25 brake because, according to the vehicle tests, it should 
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1 stop in 133 feet or less? 

2 A. Again, I can't really speak to the tests that they 

3 ran. If you're asking me if the vehicle stops in 100 or 

4 133 feet, yes, that's going to stop the vehicle before 

5 the ditch. But I can't help you with regard to their 

6 tests because I don't know what the parameters for their 

7 test. But you're absolutely right. If the vehicle stops 

8 in 100 feet, it's not going to hit the ditch. 

9 Q. And that would be timely? 

10 A. Yes. 

11 Q. According to your analysis. If a vehicle with a 

12 closed throttle and service brake application can stop in 

13 133 feet or less, just asking you to assume that are the 

14 vehicle characteristics, then it would be a timely 

15 application to apply the brake where Ms. Bookout applied 

16 it ? 

17 A. Again, I can't really help you with regard to tests 

18 that have been done, because I don't know about the 

19 parameters, but if you want to ask me the question if the 

20 vehicle stopped in 100 feet or less, does it go 150, no, 

21 so does it stop before the ditch, yes. I mean, I can't 

22 answer it any other way. 

23 Q. With brake application they can stop the vehicle in 

24 133 feet or less, that would be a timely brake 

25 application in your definition of this scenario? 
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1 A Yes. 

2 Q. You also told me in your deposition that based your 

3 research women in these types of circumstances can apply 

4 as much as 100 pounds of brake force, correct? 

5 A. Yes. 

6 Q. In terms of your analysis and research you looked 

7 at, are all the people that claim to have UA, events are 

8 they simply just mistaken in your opinion? 

9 A. I can't really tell you about all of these 

10 individuals. What I do in my analysis is look at factual 

11 basis for each case, if there's a specific case. If 

12 there's a paper related to UAs, then I can certainly read 

13 that. But I have to look at all these things 

14 individually. I don't have the capability to say in 

15 general sense everything can be clustered together. 

16 Q. I want to be clear about something here. In terms 

17 of the -- you offered the opinion that the skid mark, the 

18 150 skid mark was left by the service brake. Tell me how 

19 you arrived at that opinion? 

20 A. Well, that's just based on what we talked about 

21 earlier, in terms of what drivers typically do in 

22 emergency situations. And so if a driver is an emergency 

23 situation for a duration such as this and they become 

24 panicked and hypervigilant, they have a perceptual 

25 narrowing phenomena where they process visual 
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1 information, stop thinking rationally and continue to 

2 elicit a response which prevents them from engaging in 

3 secondary activities like shifting into another gear, 

4 turning the ignition off, pulling a hand brake. 

5 Q. Did you hear Mr. Walker testify, I think you were 

6 here, that in his opinion there was no way to determine 

7 whether that skid mark was left by the service brake or 

8 the hand brake? 

9 A. I don't recall that. 

10 Q. And did you consider in reaching your opinion the 

11 fact that Ms. Western testified Mrs. Schwarz said 

12 immediately after the wreck that Ms. Bookout had pulled 

13 the emergency brake? 

14 A. Yeah. I think we asked me that already, yes. 

15 Q. Did you watch Ms. Western's video deposition? 

16 A No. 

17 Q. She repeatedly in the deposition moved her arm when 

18 she was explaining that she saw the brake pulled up. 

19 Were you not aware of that? 

20 A. I didn't see the video. 

21 Q. And based on your analysis, you've just got to 

22 determine that Ms. Western was just wrong in what she 

23 saw, isn't that right? 

24 A. Well, I didn't look at her deposition and then say, 

25 well, she must have wrong, but I certainly considered all 
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the other facts, such those of the paramedic that 
testified earlier that he had in fact looked at the 
situation as he was trying to extricate Mrs. Bookout and 
recalls a different set of facts. So those coupled with 
the scientific literature are certainly at odds, as you 
like to say, don't square up with the testimony of 
Ms. Western. 

Q. The paramedic didn't say he saw it, he just said he 
heard a click. Isn't there a difference between hearing 
a click and somebody actually seeing it? 

A Well, certainly, but as I recall, he said that her 
hand was on, he removed it, that he heard the click, so 
he didn't actually see the movement of it, that's 
correct. 

Q. So you have got to completely ignore the fact that 
Ms. Western said she saw it in the up position as the 
first person at the car, you've got to ignore that for 
your analysis? 

A. I'm not ignoring it. I'm certainly indicating that 
there's other information that is contrary. And we know 
the resting position of it is up above the console. So I 
mean, there are other facts in addition to what her 
statement is. And I'm not saying her testimony is in 
some way inaccurate of what her memory is at all. That's 
certainly what her memory is of the event. 
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1 Q. So it would be your position that you're going to go 

2 with the testimony from the EMT that Ms. Bookout, who had 

3 suffered a closed head injury and has crushed vertebra 

4 and broken back and actually reached over and pulled it 

5 up as opposed to believing Ms. Western? 

6 A. Well, again, it's not just believing, it's 

7 considering all the information that I have available to 

8 me, including the scientific literature which indicates 

9 something quite different. 

10 Q. But you're relying on scientific literature instead 

11 of what Ms. Western said she saw, right? 

12 A. No, again, I'm considering all the evidence 

13 together. 

14 Q. If you're not considering it for your opinion you 

15 would have to reach the opinion that the brake was up. 

16 You're telling it wasn't, so you have to be discounting 

17 Ms. Western's testimony? 

18 A. I'm not discounting it. I'm saying it is contrary 

19 to what the paramedic had said, and it's contrary to what 

20 the scientific literature says. 

21 Q. Were you here for Mr. Walker's testimony when he 

22 told us about how the emergency brake works, that it 

23 actually had 12 individual ticks, that somebody can pull 

24 it, stop, pull it again and stop, and pull it again. 

25 Were you here for that testimony? 


THIS TRANSCRIPT IS NOT PROOFREAD 



32 


1 A. I don't remember him talking about 12 clicks. 

2 Q. Just take my word for it he did. Assuming that he 

3 did. isn't it possible to square your testimony that Ms. 

4 Bookout pulled it, just like Ms. Western said she saw, 

5 and then as she was getting out she bumped it and it went 

6 a couple more clicks? 

7 A. I don't think she bumped it because he said he had 

8 to remove her hand off it. And again, be contrary to 

9 what the scientific literature says about what drivers do 

10 in emergency situations. 

11 Q. Assume for me that Ms. Bookout's vehicle with no 

12 throttle is capable of being stopped in 133 feet with 

13 just service brake application. Are you with me so far? 

14 A. Yes. 

15 Q. The fact that it didn't stop in this case. Doesn't 

16 that indicate that she actually was experiencing an 

17 unintended acceleration that prevented the vehicle from 

18 stopping? 

19 A. Again, I don't -- I don't have the capability to 

20 give you a time/distant measures as an accident 

21 reconstructionist, but certainly if you define a 

22 situation like this where there's a failure to stop the 

23 vehicle and the driver perceives the vehicle's running 

24 away, she's hitting the accelerator instead of the brake, 

25 or she's not pressing the brake in timely way, then you 
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1 can have the accident. 

2 Q. Let me do my hypothetical again? 

3 A. Okay. 

4 Q. We're at the point where the skid mark begins, all 

5 right. Follow me? 

6 A. Yes. 

7 Q. And she applies the service brake here and is off 

8 the throttle. And we assume that the vehicle under that 

9 condition is capable of being stopped at 133 feet but it 

10 doesn't, doesn't that tell you that she is actually 

11 experiencing an unintended acceleration where the 

12 throttle is open? 

13 A. No. 

14 Q. Why is that? 

15 A. Well, let's say, for example, she's not applying 

16 sufficient force, then the car is not necessarily going 

17 to stop in that period of time. 

18 Q. But you just told us in a circumstance like this 

19 that the brake application would be ballistic? 

2 0 A. Yep. 

21 Q. So that should be sufficient force to stop the 

22 vehicle, shouldn't it? 

23 A. Well, again, we don't know the amount of force that 

24 she produced. 

25 Q. So isn't it really what it comes down to in this 
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1 case is it's not failure to timely apply the brake, but 

2 it's a failure to apply enough pressure to the brake 

3 pedal, isn't that what you're saying? 

4 A. No. 

5 Q. As the vehicle was coming off the road you discussed 

6 what you understood the fact to be at 60 miles an hour 

7 coming down 40 -- you told me 40 in your deposition, but 

8 let's just go with what said here in court, 45 to 50 when 

9 she start leaving the skid mark, okay, are you with me so 

10 far? 

11 A. Yeah. 

12 Q. If she has a pedal misapplication where she is 

13 hitting the accelerator instead of the brake, shouldn't 

14 the vehicle accelerator instead of slow down? 

15 A. Yes. 

16 Q. But we know it went from 60, 65 down to 45 or 50, 

17 right? 

18 A. Yes. 

19 Q. So, it didn't speed up when it came off the ramp, it 

20 actually slowed down, didn't it? 

21 A. Yes. Overall, certainly. 

22 Q. So doesn't that tell you that more likely than not 

23 for your analysis it would be not a pedal misapplication 

24 but delayed application? 

2 5 A. No. 
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1 MR. BAKER: That's all I've got, thank you. 

2 THE COURT: Redirect. 

3 MR. BIBB: Yes, ma'am, thank you. Your Honor. 

4 Just one moment. 

5 REDIRECT EXAMINATION 

6 BY MR. BIBB: 

7 Q. Dr. Young, just a very few questions here. Do you 

8 recall reviewing Ms. Bookout's testimony for trial? 

9 A. Yes. 

10 Q. Did she say she panicked? 

11 A. Yes. 

12 Q. Does that fit in with what you've been talking 

13 about. Classic driver reactions when they are having 

14 pedal error? 

15 A. Yes. 

16 Q. Would you tell the jury about how that works? 

17 A. Sure. I mean, one of the reasons why you have 

18 delayed responses, if appropriate responses at all, is 

19 because when drivers are in emergency situations and they 

20 think the vehicle is running away from them, they stop 

21 thinking rationally. They become panicked. Some drivers 

22 freeze, some drivers engage in habitual responses like 

23 continuing to do what they are doing, others press 

24 different ways, for example, pressing the accelerator 

25 harder. So all of that is part of this hypervigilant 
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1 state where they begin to process information visually, 

2 start steering and start engaging in those kinds of 

3 activities instead of thinking about other alternatives. 

4 Q. There was some questions about whether the vehicle 

5 could be stopped in a certain distance. You were here 

6 for Mr. Walker's testimony, were you not? 

7 A. Partly. 

8 Q. Part of it, his cross-examination, redirect 

9 examination this morning. It's a function of how hard 

10 you press the brake pedal is one factor that needs to be 

11 considered on how short a distance the vehicle is 

12 stopped, correct? 

13 A. Yes. 

14 Q. And is that something -- you haven't tried to figure 

15 out how hard she pressed the brake pedal? 

16 A. I have not. 

17 Q. Would be your opinion that for the distance she had 

18 left and the moment that the service brake was applied, 

19 she didn't press it hard enough to stop the vehicle prior 

20 to going through the intersection? 

21 A. Yes. 

22 Q. And would you consider failure to apply the brake in 

23 a timely manner and apply it then firmly enough to stop 

24 the vehicle a pedal error? 

25 A. Yes. 
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Q. One last thing. Are you up here blaming Ms. Bookout 
for this accident? 

A. No. 

Q. I think one of the things you told us earlier was 
pedal errors are made commonly? 


A. 

Yes. 



Q. 

Minor ones? 



A. 

Yes . 



Q. 

And major ones once every, what,500 

foot movements? 

A. 

Roughly, four or five 

hundred. 


Q. 

That doesn't make her 

a bad person 

if she made a 

pedal 

error? 



A. 

No. We make mistakes 

all the time. 

For example, if 


you are probably an Oklahoma Thunder fan, you see people 
shooting free throws all the time, right? One of my 
favorite players, Russell Westbrook from UCLA, doesn't 
make 100 percent of all of his free throws. Why? 

Because we can't produce the responses that we are trying 
to accurately every single time so we have few minor 
errors. So that's the nature of being human. We 
sometimes make mistakes. It's not doing it in a 
purposeful way. In fact, he's trying the make the 
baskets but he can't always, and that's the way it is 
when we operate the vehicles that we drive on the road as 
well. We're not always executing the responses as we 
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1 would like. 

2 Q. Now, one of -- my last a couple of questions here. 

3 One of the areas that Mr. Baker asked you about was some 

4 work for NHTSA, the National Highway Traffic Safety 

5 Administration and NASA that I believe was published in 

6 2011. Are you familiar with that material? 

7 A. Yes. 

8 Q. And Mr. Baker suggested to you that Toyota had 

9 failed to turn over some software code or had -- you 

10 didn't know the 400 percent increase in -- I think you've 

11 remembered to them as UA claims, maybe speed control 

12 claims, I think is what they actually are. 

13 Have you seen what NHTSA said in the final report 

14 there? Do you rely on that? 

15 A. Yes. 

16 Q. And -- let me have the Elmo please. This is a 

17 report that we saw the cover of, correct? 

18 A. Yes. 

19 Q. Exhibit No. 36. This is an executive summary, I'd 

20 like to direction your attention. I'll try to make this 

21 as big as I can. And this was -- didn't you tell us 

22 earlier they were just looking at Toyota vehicles? 

23 A. Yes. 

24 Q. And tell me if I read this correctly, "After 

25 conducting the most exacting study of a motor vehicle 
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1 electronic control system ever performed by a government 

2 agency, NASA," that's the National Aeronautics and Space 

3 Administration, "did not find that the ETC," that's the 

4 electronic throttle control, electronics are a likely 

5 cause of the large throttle openings in Toyota vehicles 

6 as described in consumers' complaints to NHTSA. NASA 

7 found that many safety features are designed into the ETC 

8 system to prevent UA," that's unintended acceleration, 

9 "and if faults are detected to cause the initiation of 

10 safe modes of operation that limit acceleration, for 

11 example, limp home, fuel cut strategies. 

12 "NASA found no flaws in the software code 

13 controlling the Toyota ETC system that would cause UA. 

14 NASA also found that electromagnetic compatibility, EMC 

15 testing at exposure levels well above current 

16 certification standards did not produce an open throttle. 

17 "NASA found no evidence that any failures of the ETC 

18 system had an effect on the performance of the braking 

19 system." 

20 Did I read that correctly? 

21 A. Yes. 

22 Q. Are you familiar with those conclusions? 

23 A. Yes. 

24 Q. And at any time, Mr -- Dr. Young, in the last two 

25 years and two and a half years that's there been any 
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1 

suggestion that you're aware of from NASA that they 

2 

wanted to change these findings? 

3 

A No. 

4 

Q. Has there been any suggestion they need to reopen 

5 

because of allegations made about the software? 

6 

A. Not that I'm aware of. 

7 

MR. BIBB: Thank you. That is all I have. 

8 

THE COURT: Dr. Young, you may step down. 

9 

Mr. Bibb, you may call your next witness. 

10 

MR. BIBB: We call Mr. Ashish Arora to the 

11 

stand. 

12 

ASHISH ARORA, 

13 

Called as a witness, after having been first duly sworn. 

14 

testified as follows: 

15 

DIRECT EXAMINATION 

16 

BY MR. BIBB: 

17 

Q. Mr. Arora, would you please tell us your full name? 

18 

A. My full name is Ashish Arora. 

19 

Q. Mr. Arora, are you from Oklahoma? 

20 

A. I'm not, no, sir. 

21 

Q. Okay. Where were you born? 

22 

A. I was born in New Delhi, India. 

23 

Q. And did you go to school first in Australia? 

24 

A. My dad's a diplomat so I moved countries every three 

25 

years. So every three years I changed schools, I change 
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countries, and I've been here since 2001. 

Q. And when you came to the -- did you get a degree 
first in Australia? 

A. I did, yes, sir. 

Q. Where did you go to school there? 

A. I went to school in Camber, Australia, I got my 

bachelors degree from there. 

Q. Is Camber the capitol? 

A. I believe it is, yes. Very small town but it's a 
capitol, yes. 

Q. And after you came to the United States, did you 
attend college here as well? 

A. I did. I got a master's degree from Perdue 
University and in graduated in 2003. 

Q. And what was your undergraduate and master's degrees 
in? 

A. My bachelor's degree is in electronics and 
communications engineering, and then my master's is in 
electrical and computer engineering. 

Q. And where do you work? 

A. I work for a company called Exponent out of their 
Phoenix, Arizona office. 

Q. And we've heard about Exponent, in fact, you were 
here this morning when I was talking to Dr. Young about 
Exponent. How long have you been with Exponent? 
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A I started right after I graduated, and this was 
around early 2004 and I have been there ever since, about 
nine and a half years. 

Q. What is your position there? 

A. Currently I'm a principal engineer in the electrical 
and computer engineering group at Exponent. 

Q. And as a principal engineer in the, what did you say 
the electronics and — 

A. Electrical and computer engineering. 

Q. In electrical and computer engineering, what sort of 
work do you do? 

A. Essentially you have different technical levels at 
Exponent. You start off as an engineer, then you become 
a senior engineer. The principal engineer is the highest 
technical level you can get at the company. And you do 
the same technical work, but you are authorized to sign 
off on other people's work product. We have this quality 
management system which involves stringent reviews and 
I'm authorized to sign off on other engineers' work 
products. 

Q. Now, and what sort of things do you do for Exponent? 
What sort of projects do you work on? 

A. Typically I'm retained by my clients to help answer 
two types of questions. Question number one, these 
products are not made by my company, the designs are 
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1 taking place in Asia, they are happening in China, Hong 

2 Kong, Taiwan, should I putting my company's name on this 

3 product. Is the electrical design, the software design 

4 safe, or is it going to cause problems in their field. 

5 So that's the typical type -- one type of projects. 

6 Another type of project is, Ashish, these products 

7 are failing in the field, can you tell us what's going on 

8 and how we can fix these problems so that they don't 

9 occur in the field anymore. That's predominantly the 

10 type of work that I do. 

11 Q. And how much of your work involves software? 

12 A. That varies from project to project. I would say 

13 about 30 to 40 percent of my work, more recently than a 

14 few years ago has involved software. 

15 Q. And what sort of software experience do you have? 

16 A. I've worked on a number of large projects. They 

17 varied from software issues in soap dispensers. So 

18 you're all familiar with the soap dispensers where you 

19 put your hand under it and it dispenses soap. 

20 I've worked on projects where these, what's called 

21 ghost dispensing occurs. So randomly the soap will start 

22 leaking out of these products and people will start 

23 falling because they don't know there's soap on the 

24 floor. So I was asked to find out what gives, what's 

25 wrong with our software. 
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1 Another project, very large project involved an 

2 analysis of a monorail system. The monorail system had 

3 parts falling down, and I was part of a big team, 

4 software team programming the instrumentation to find out 

5 why stuff was falling down in Las Vegas on people's 

6 heads. 

7 I've worked on other projects. A large train 

8 accident that occurred in DC. And essentially we were 

9 hired -- we were retained by the company that made the 

10 software for the operators who track the trains going up 

11 on the screen. And the allegation was that the trains 

12 just disappeared from the scene so the operators couldn't 

13 guide the drivers. So I was asked to figure out if the 

14 software could do that. 

15 So that's just an idea of the type of projects that 

16 I'm involved in. 

17 Q. Have you been asked to evaluate the software of the 

18 electronic throttle control system in the 2005 Toyota 

19 Camry? 

20 A. I think my role was not just limited to the 

21 software. I understand my role as being is there 

22 something in the electronic throttle control of the 2005 

23 Camry at the software level, at the hardware level, or at 

24 the system level that can explain the vehicle taking off 

25 despite depressing the brake pedal and that can 
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1 explanation -- more importantly explain what Ms. Bookout 

2 said happened with her vehicle. So that's how I 

3 understood my scope of work here. 

4 Q. Fair enough. And when did you first start working 

5 on trying to evaluate where there was something in the 

6 software, the hardware, or the electronic throttle 

7 control system overall in the 2005 Camry that could 

8 result in unintended acceleration? 

9 A. In this matter or generally? 

10 Q. In generally. 

11 A. I believe it was early last year in 2012, there was 

12 another matter that I was retained in which had the same 

13 vehicle, so it would have been March, April 2012 around 

14 that time frame. 

15 Q. So have you spent off and on a year and a half or so 

16 looking into this? 

17 A. I work on a lot of projects, but over a year and a 

18 half time frame, I've spent a substantial amount of my 

19 professional working time looking into this. 

20 Q. Now, does your work sometimes involve litigation? 

21 A. It sometimes does, yes. 

22 Q. And how often does that occur? 

23 A. It's not very often. I've testified in court once 

24 before, so I'm a little nervous today, but I typically 

25 don't work in litigation settings. 
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1 Q. Now, let's go focus right on, so you've had some 

2 background in the Toyota electronic throttle control 

3 system, been working off and on on that for a year and a 

4 half or more. Have you been exposed to the facts of the 

5 Bookout case? 

6 A. I have been, yes, sir. 

7 Q. How did you learn about that? 

8 A. I believe when I was retained on this matter I was 

9 provided a set of documents, which included the complaint 

10 in this matter, Ms. Bookout's deposition testimony, and 

11 other question and answers that the lawyers typically ask 

12 each other. And there were stuff like the police report, 

13 I got some scene photographs, and some additional 

14 information about the vehicle. I got this big document 

15 package and that's how I got up to speed. 

16 Q. Have you been to apply what you have learned about 

17 the Toyota electronic throttle control system to your 

18 analysis of the Bookout crash? 

19 A. I believe so, yes. 

20 Q. Have you -- and we're going to go through this in 

21 some detail, but have you reached some conclusions and 

22 opinions in this case? 

23 A I have, yes, sir. 

24 Q. Have you reached those opinions and conclusions 

25 within a reasonable degree of engineering and scientific 
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certainty? 

A. Yes, sir. 

Q. And let's just tell the jury quickly what are the 
basic opinions that you're going to offer in this case? 

A. The two opinions that I have, number one is, there's 
really no realistic fault in the software, the hardware, 
or the system, the throttle control system, that can 
explain what Ms. Bookout said happened with her vehicle 
and that can cause the vehicle to take off despite 
someone applying the brake pedal. 

And number two, if you look at the system design, 
the way the system is designed, I like to think of it 
like having a layered or a network of failsafe architect, 
so that failures, however rare, if they occur, they will 
be detected and the vehicle will be transitioned to a 
predesign mode. 

So the idea here is, have we know sometimes failures 
can occur, the question, can those failures be caught. 

And my review of the failsafe architecture says that any 
failure, any realistic failure will be caught in the 
vehicle and will transition the vehicle to a predesign 
mode of operation. Those are the basic two opinions. 

Q. And when we talk about these mitigation strategies 
or failsafes, are those what you're talking about 
catching any kind of problem? 
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A. Yes, sir. 

Q. And I think the jury may have heard from a Mr. Barr 
a week or so ago, have you also looked over his work? 

A. I have, yes, sir. 

Q. And in fact, in reviewing his work last year, did 
you find that he made a mistake in how he is assessed the 
system? 

A. I think last year when we worked on these cases, I 
-- there was a simultaneous exchange of expert reports, 
so I was supposed to submit my report on this matter and 
Mr. Barr was supposed to submit his report in the matter 
we were working on. And when I got Mr. Barr's report, he 
said things that just didn't make sense to me. I wasn't 
sure why he was saying this because it was pretty obvious 
that what he was saying was happening could not happen. 

And then I found out that somewhere in the middle of 
his report he had a footnote that said that he had 
deleted source code. And that source code deletion 
resulted in him reaching the conclusions that he reached. 

And so, we pointed that out to him and then he 
corrected his errors in that matter. 

Q. And we go -- 

MR. PORTIS: May we approach? 

(THE FOLLOWING PROCEEDINGS WERE HAD AT THE BENCH 
OUTSIDE OF THE HEARING OF THE JURY.) 
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1 MR. PORTIS: We had a ruling from the Court 

2 that he was not supposed to use the word, mistake. You 

3 indicated that he can use the word error. 

4 THE COURT: I'm not going to bring up to the 

5 jury, I did say mistake, it was big mistake that I was 

6 concerned about and we did talk about an error that 

7 occurred. 

8 (THE FOLLOWING PROCEEDINGS WERE HAD WITHIN THE 

9 HEARING OF THE JURY AS FOLLOWS:) 

10 Q. (BY MR. BIBB) Now, have you prepared a few slides? 

11 A. Very few, yes. 

12 Q. Okay. Dr. Arora, let's start at the beginning here 

13 and just an overview of how the electronic throttle 

14 control system works? Have you prepared a slide to 

15 discuss that? 

16 A. I do. I have a couple of slides, yes. 

17 Just at a very high level, I have an animation here 

18 that shows what happens in this 2005 Camry when a driver 

19 presses the accelerator pedal. How do we start moving 

20 the vehicle. Essentially, when you press the accelerator 

21 pedal, electrical signals are generated. Those signals 

22 go from the accelerator pedal to the engine control 

23 module, or what I like to think of as the brains of the 

24 system. 

25 The engine control module takes those signals and 
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says, you know, the driver wants to drive at so much 
speed at so much throttle opening angle. The engine 
control module then tells what's called a throttle 
control motor, this is what the driver wants me to do. 

And the throttle control motor is then responsible 
for opening the throttle valve. If you look at the 
throttle valve, it's just a plate. It's what in the 
literature is called a butterfly valve. When you have no 
power to that valve it's 6.5 degrees. And there's some 
air going in when you have no power to it. When you 
start your engine at you're at idle, the thing is 
actually closed. There are two springs in it, so when 
you have no power to it, two springs counteract and 
balance each other out and you're at 6.5 degrees. 

When you're at idle, you close the valve and 
typically about two or three degrees. If you have your 
radio, if you have your air conditioning on, you may be a 
4 degrees, but typically, 2 to 3 degress. 

When you start accelerating, you start opening that 
valve. Wide open throttle, all the way, fully open is 84 
degrees. So you will range from 1 to 2 degrees to 84 
degrees normal operation. And when there's no power, 
you're at 6.5 degrees. 

So let's say someone presses the accelerator pedal 
and the engine control module, which is the brains of the 
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system determines I need 10 degrees throttle opening. It 
tells the throttle control motor, open the valve to 10 
degrees. The throttle control motor opens the valve to 
10 degrees. 

There are two sensors in this assembly, the throttle 
position sensors. Those feedback information to the 
engine control module, and if they feedback 9 degrees 
when it should be 10 degrees, the engine control module 
will say to the throttle control motor, you didn't do 
what I ask you to do, open it further. And if they 
feedback 11 degrees instead of 10 degrees, the engine 
control module will say, we open or close the throttle 
valve. 

So this process and this feedback process occurs 
hundreds of times a second. So hundreds of times a 
second the engine control module is updating what it 
wants the throttle control motor to do, and hundreds of 
times a second, the throttle position sensor is providing 
feedback, and the engine control module is using that 
feedback, and what the accelerator pedal is telling it to 
decide what the throttle valve should be doing. 

So at a very, very high level this is what the 
system does. This is what happens when you press the 
pedal and your vehicle starts to move. 

Q. Okay. Now, what are these two graphs here that we 
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1 see? 

2 A. So, do you mind if I use the sketch board? 

3 Q. Sure. 

4 A. Essentially we focus on these two signals. 

5 THE COURT: I'm not certain everyone can see. 

6 MR. BIBB: Bring it down over here. 

7 A. So they are focused on these two signals over here. 

8 These are the accelerator pedals. When you press the 

9 accelerator, this is zero, this five. The accelerator 

10 pedal generates what's called -- 

11 THE COURT: You're going to have to talk a lot 

12 louder. 

13 A. So the accelerator pedal signal is generating 

14 voltage, which is just an electrical signal. When you're 

15 at idle, there are two sensors in there. When your 

16 accelerator is not pressed, one sensor says the voltage 

17 is .8 volts, and the other one says 1.6 volts. The 

18 engine control module uses this line to find out what the 

19 driver wants. So if I'm over here and that's the engine 

20 control module thinks the driver wants to open the valve 

21 about 50 percent. If I'm over here, 75 percent. So the 

22 engine control module is going to read what this value is 

23 and then decide what the driver wants. 

24 Then second sensor signal is the check, this is what 

25 the engine control module uses to make sure that the 
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original signal is actually what the driver is doing and 
nothing has failed. So there's a set of 10 to 12 checks 
that are performed to make sure that in the event the 
signal fails, there is a monitoring for that signal. 

So in effect what you have is, you have a double 
process on the accelerator pedal with the original signal 
and the monitor. 

The same thing happens on the throttle side. Same 
idea. One signal tells you what the valve position is 
and the second signal tells you whether the first valve 
position is -- and that's just a way of connecting. And 
that's essentially what those two are. 

Q. Let's go to the next slide. Now, is this just a 
schematic of what you were just showing us? 

A. This is just a block diagram. And essentially what 
I wanted to show here is the engine control module, which 
is the brains of my system, is controlling the throttle 
valve by using signals from the accelerator pedal, but 
it's using other signals as well. The cruise control 
switch, so if I'm in cruise control, that also allows me 
to open the throttle valve. The mass air flow meter is 
providing it feedback. The throttle position sensor is 
providing it feedback. 

So there are multiple signals that are going into 
the computer system, the engine control module to 
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1 determine what the throttle valve should do. 

2 In addition to controlling the throttle valve, we 

3 don't only need air in the engine, we also need fuel, and 

4 we need spark and we need ignition. This engine control 

5 module controls those two systems as well. It controls 

6 what fuel goes into the engine, it controls how the 

7 ignition coils are driven. 

8 So essentially, the reason I think about this as the 

9 brains of the system is because this is what's driving 

10 the car. 

11 Q. Now, would this be considered an imbedded system? 

12 A. I think so. I think this would be an imbedded 

13 system, yes. 

14 Q. So what are -- would it be like an iPhone, for 

15 example? Can we go to the next slide? 

16 A. It's almost like an iPhone, but not quite. 

17 Q. What's the difference between -- you need to press 

18 the button. 

19 A. Sorry. An imbedded system is just a fancy word for 

20 a computer system that only does one particular job. So 

21 the traffic lights on our streets, those are imbedded 

22 systems. If you have digital watches, those are imbedded 

23 systems. Microwaves, those are imbedded systems. When 

24 you get those things, if we look at a microwave, the only 

25 it's going to do is heat your food, respond to the 
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buttons. You cannot make it do other things. It's 
designed to do something. 

So in my mind, an imbedded system is a computer 
system that does a particular job. So when I look at the 
Camry throttle control system, that's an imbedded system 
because what it's doing is it's controlling the throttle 
valve, the fuel injectors, and the ignition coils. 

The iPhone would not be a typical imbedded system 
because I can download apps and I can make it do other 
things, depending up what apps you want. 

The other critical thing about imbedded systems and 
what differentiates one imbedded system from another is 
how you design it. I will design a traffic light 
completely different from how I would design my digital 
watch. How I design my microwave will be completely 
different than how I design an airplane. 

So if we look at an iPhone, for example, in an app 
crashes, something stops working, I can reset the system, 
I can turn the power off and turn it on. So the iPhone 
is designed with one computer system and the idea is that 
computer system doesn't do what it's supposed to do, then 
I restart the phone and everything is back to normal. 

I can't quite design my throttle control system in 
the same manner because if the computer that's running 
everything fails, I need to have a backup. And the 
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backup in the Camry imbedded system is having a second 
computer chip. Just like I was showing you the two 
accelerator pedal signals, the first computer chip does 
the job of controlling the throttle valve, and the second 
computer chip makes sure that the first computer chip is 
doing what it's supposed to. So it's a monitoring chip. 

I don't need a monitoring chip in my iPhone because 
if it fails I can just restart it. Another example of an 
imbedded system would be an airplane. In my Camry, if my 
second chip detects a problem with the first chip, I go 
into what you have all probably heard is called a 
failsafe mode. I cut power to the throttle. 

I can't quite do that with an airplane because I 
don't want my throttle to lose power if I'm up in the air 
at 30,000 feet. So when I design my airplane I will 
design it differently. I may design it with three chips 
or four computer chips, just like I have two engines, so 
that if one fails, I can still land the plane safely. 

Similarly, if I have a microwave, I will probably 
have a very simple computer chip. So the idea is, if we 
have an imbedded system, we can have all these general 
items under the same umbrella, but how you design each 
item is limited to what that item is there for and what 
the application is, what the failures of those 
applications are. 
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And in my mind, if we compare something like an 
iPhone with something like a Camry and use that 
comparison to reach conclusions, it would be very 
misleading because if I use that same analogy and compare 
an iPhone with an airplane, I can see how misleading this 
whole analogy is. 

Q. So now, we've talked a little bit about there being 
two computer chips in the controller for the Camry. 

Let's take a look at what that controller actually looks 
like. Could you see the next slide Dr -- I mean, Mr. 
Arora? 

A. The heart of the vehicle is essentially what's 
called the printed circuit board. And that's just a term 
used to describe the connection of different electrical 
components together. 

Q. Is this actually a 2005 Camry circuit board? 

A. I believe it is, yes. 

Q. Okay. 

A There is the main computer chip or the main 
processor, just this black rectangle that you see with 
hundreds of vents. Then there is a second computer chip, 
or the subprocessor, and that subprocessor exists to 
monitor what the main processor is doing. So someone 
presses the accelerator pedal, the main processor says 
open the throttle 20 degrees, the main processor will 
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send a command to the throttle driver. The main 
processor doesn't open the throttle. It's the throttle 
driver that opens the throttle. 

So the throttle driver will have to apply power to 
the throttle. The only power I have in my vehicle is the 
battery or the alternator. That power is inadequate for 
driving the electronics. So the power supply takes what 
my battery gives out or what my alternator gives out and 
converts it to a form that I can use drive all the 
electronics. 

So for throttle control, these are the four main 
items: The two computers, the throttle driver, and the 

power supply. 

Q. Go ahead. 

A. You'll see hundreds of other components positioned 
all around these chips. There are some smaller black 
units, some really small black units, some cylindrical 
units, all these components are protection units, they're 
there to protect these computers, these two processors, 
the throttle driver and the power supply, to prevent them 
from stuff they might be exposed to in the field, high 
temperature, electrical noise, and to make sure that they 
work as they are designed to work. 

So at a high level, this is what the computer system 
looks like. 
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Q. Now, do we have simplified schematic of the computer 
system or block diagram? 

A. We do. So these are the four components that I 
showed you on the previous slide. I've got my 
subprocessor, I've got my main processor, I've got my 
throttle motor, and I've got my power supply. And 
there's no throttle valve. 

A driver depresses the accelerator pedal and the 
signals change like I showed you on the plot over there. 
Those signals are what are called analog signals. If you 
have toaster oven at home, you probably have an analog 
dial that changes continuously. That's different from a 
microwave which has buttons. Those are digital signals. 

So an analog signal of the type you see over here 
continuously changes the signals. And if I change the 
depression even slightly, the signal will change. So 
that way I've got a continuously changing signal here. 

The problem with the continuously changing signal is 
computers don't like continuously changing signals, they 
only like ones and zeros. The only things computers can 
deal with is ones and zeros. So something, needs to 
convert this continuous signal into one and zeros. I 
need to go from analog to one and zeros, which is 
digital. That's what this guy does, the analog to 
digital converter. It takes the continuously changing 
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1 signal, converts it ones and zeros. 

2 Those digital signals, the one and zeros, are sent 

3 from the analog to digital converter, independently to 

4 both the main computer, or the main processor, and the 

5 monitor computer, or the monitor CPU. 

6 So imagine someone presses the pedal asking for 20 

7 degrees throttle opening angle, that 20 degrees will be 

8 converted to 20 degrees in zeros and ones, and it will be 

9 sent to the main processor. The main processor will 

10 recognize what the driver is wanting and tell the 

11 throttle motor driver, open the valve to 20 degrees. And 

12 it's going to do this hundreds of times a second. 

13 Hundreds of times a second it's going to see what the 

14 pedal is saying and it's going to open the throttle 

15 valve. 

16 Once the throttle value is open, the throttle 

17 sensors will feed back signals telling the main computer, 

18 hey, I'm at 19 degrees, I'm not where you think I'm 

19 supposed to be. The problem is, just like with the pedal 

20 signals, the throttle signals are also analog so they are 

21 continuously changing and so we need to convert them to 

22 ones and zeros. 

23 The same analog to digital converter does the 

24 conversion process. And again, this feedback is provided 

25 hundreds of times a second. All these things are 
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happening at less than a blink of an eye and they are 
changing all the time. 

And so the main processor or uses feedback and the 
original signals to determine what the throttle valve 
should be. 

The throttle control system has two analog to 
digital converters. There's one that's physically 
located in what we call the subprocessor chip, and 
there's another one that's physically located in what we 
call the main processor chip. 

When power is supplied to a throttle valve that 
power is monitored. Just like with the pedal and 
throttle signal, that power is also analog. So the ones 
and zeros conversion of that power on motor current is 
performed in a second A to E converter. And this second 
A to D converter is essentially used to essence to make 
sure that the primary A to D converter is doing what it's 
supposed to do. So it's a monitoring -- I like to think 
of it as a monitoring converter for the main A to D 
converter. 

Q. So what about this feedback loop with the power 
supply? 

A. The power supply is converting the 12 volts from the 
battery or the alternator into something that the 
throttle valve can use. 
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1 Q. So this is our system here, but you mentioned early 

2 in the examination that the vehicle uses a layered 

3 failsafe architecture, and that failsafes are implemented 

4 in the vehicle to prevent any software or hardware fault 

5 in the electronic throttle control system from giving an 

6 unintended command, correct? 

7 A. That's correct. 

8 Q. How does that work? 

9 A Well, so there are literally hundreds of failsafes 

10 in there. I'm just going to pick an example. Let's say 

11 the feedback from the throttle sensors, there's two 

12 signals that are fed back. One signals tells the main 

13 computer my throttle is open 10 degrees, and the other 

14 one says, no, I'm open 15 degrees. I'm got a mismatch 

15 between the two signals. 

16 The main processor will say the two are not 

17 agreeing, these are my critical signals, something's gone 

18 wrong. And what the main processor then does is it 

19 essentially cuts power to the throttle motor. It says I 

20 don't care what's gone wrong, I'm going to remove power 

21 to the throttle motor. And now I go to 6.5 degrees I was 

22 telling you before. There's no power going to the 

23 throttle valve, it's at 6.5 degrees. 

24 And if this happens when I'm on the road driving, I 

25 will lose power but I will have enough power to pull to 
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the side of the road. So I believe that's why they 
design it. I don't know why they do it. But that's what 
makes sense to me. 

And so if the main processor detects any of the 
hundreds of faults that it's designed to detect, it can 
cut power to the throttle motor by cutting power to the 
power supply. 

Q. I've heard and we talked with Mr. Barr among others 
about system guards in the vehicle. What are they? 

A. Yes. So the system guards that we have, I like to 
think of the analogy that we have, for example, in a 
circus. If you have a rope back in a circus, the person 
who's doing to rope back will have a harness connected to 
it. And the whole purpose of the harness is if he slips, 
the harness will catch him. That's is failsafe. 

In addition, the circus that I've seen, typically 
has a net at the bottom. And the net at the bottom is 
there in case my harness doesn't do what it's supposed to 
do. So the net is like a safety net, it's like a system 
guard that's saying, even though I have individual 
dedicated failsafes, if those individual failsafes don't 
do what they are supposed to do, the safety net will 
prevent anything from going wrong in the worst case. 

Q. Could we look at the next slide, Mr. Arora. So is 
this the system guards, the failsafes strategies here? 
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A. The system guards are one of the failsafe 
strategies. My review of the Toyota system and the 
documentation suggests that they have what I call a class 
level failsafe strategy. 

A class one failsafe in the system. So essentially 
the difference between the classes is what the system 
does when a failure occurs. If I have a class one 
failure, you're going to get a light on your dash but 
you're going to continue moving as if nothing happened. 
So, for example, if you have a tire pressure sensor and 
your pressure is low, you get the light that comes on, 
but you can drive your vehicle as normal. That's class 
one. 

A class 1.5 is a fault on those two signals. 

There's at least 12 or 13 checks, and I'm going off 
memory, and if any of those checks tell the computer that 
something has gone wrong, we go into this class 1.5 mode. 
What happens in this mode is the system says, I don't 
care what my pedal is asking me, I'm not going to open 
the throttle more than 15 degrees. I'm going it to limit 
to 15 degrees and that's the maximum the user can drive. 
So that's class 1.5. 

The class 2 failure is where the system guards come 
in and other failures come in. So if I have a problem 
with my processor, if my computer has misbehaved, if my 
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throttle misbehaves, if I have a memory error, if I 
memory corruption, if I have a problem in communication 
between the processor, the system will cut power to the 
throttle, and then I go to the 6.5 degrees. It doesn't 
care what the fault is, it's not allowing the driver to 
accelerate the vehicle. There is no power to the 
throttle. That's class 2. 

The class 3 failure is, the system's saying I 
ordered you to cut power to the throttle. Why is the 
throttle not at 6.5 degrees? It should be at 6.5 degrees 
if I've cut power to the throttle. 

So the system then recognizes I've lost control of 
the throttle, so if one sticks the throttle, for example, 
and something is blocking the throttle from closing, the 
system says I obviously cannot close the throttle, what 
else can I control to slow down this vehicle. And that's 
the fuel. 

So when that happens, the class 3 failure mode 
recognizing that it couldn't cut power to the throttle, 
removes the fuel so the vehicle now stops. So that's 
another system guard that I think of. It's saying I've 
lost throttle control, I'm going to remove fuel from the 
system. 

Q. Have you prepared some slides to explain this a 
little bit with a block diagram? Can we see the next 
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1 slide? 

2 A. So to explain this a little bit, I think it's 

3 instructive to understand how the system operates. The 

4 driver can accelerate the vehicle by either pressing the 

5 accelerator pedal or activating the cruise control 

6 signal. 

7 So the system will look at both these signals and it 

8 will select the appropriate signal. It will say, is my 

9 cruise asking for more throttle or my accelerator asking 

10 for more throttle? The selected output is what I call 

11 the driver request. This is what my driver wants. 

12 The throttle valve is not only controlled by the 

13 driver, the air conditioning, for example, can ask for a 

14 small opening in the throttle valve. If I have the radio 

15 on, there's a small opening. If I need to heat the water 

16 in my system, there's a small opening. 

17 So the electrical loads can also ask for small 

18 openings. In a typical normal vehicle, remember, the 

19 throttle goes from zero to 84 degrees, the electrical 

20 loads will ask for 2 to 4 degrees opening. So if you 

21 turn your air conditioning on, you may see a slight 

22 increase in your rpm. Or if your engine is too cold, you 

23 may see a slight increase in your rpm. Those are the 

24 electrical loads. 

25 So the request from the electrical loads is combined 
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1 with what the driver is asking, and the addition of the 

2 two generates the throttle request. So imagine for 

3 argument's sake 15 degrees, plus 2 degrees, 17 degrees. 

4 The throttle request is 17 degrees. The target throttle 

5 calculation will say, it look at where my throttle is 

6 currently and what my throttle request is, and once it 

7 knows what it needs to open the throttle valve, 17 

8 degrees in this case, it will send the target request. 

9 So my target request will be 17 degrees. The throttle 

10 driver which we talked a little bit before, will then 

11 open the throttle to 17 degrees. 

12 The sensors in the throttle will tell the main 

13 processor, hey, I'm not at 17, I'm at 16 degrees, you 

14 need to try harder, I'm not where I'm supposed to be. 

15 And so that feedback comes into the target throttle 

16 calculation. And at a high level, this is just what the 

17 system is performing. It's taking the driver request, 

18 electrical load requests, and opening the throttle. This 

19 is essentially how the vehicle works. 

20 Q. So then what if there's a failure in the system, 

21 what happens next? 

22 A. So if we talk about the system level failures. Now, 

23 obviously, there's a lot of software and hardware that 

24 goes in each of these blocks, but if we look at the 

25 system level failures, there are three system guards. 
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1 There are three of these safety nets I was telling you in 

2 the circus. This is my system again. 

3 The system guard one looks at the target request and 

4 it looks at where the throttle is, and the system guard 

5 one says, I asked the throttle to be at 15 degrees 500 

6 milliseconds ago, half a second ago. I'm not at 15 

7 degrees. I could be at 16, I could be at 17, or I could 

8 be at 35. I'm not where I'm supposed to be within half a 

9 second. If that's the case system guard one failsafe 

10 operates and it cuts power to the throttle. 

11 So essentially if you look at system guard one, it 

12 detects for any failure in the subsystem and it says, I 

13 don't care what the failure is, I don't care if the 

14 failure is in the throttle, I don't care if the failure 

15 is in the throttle driver, I don't care if the failure is 

16 in this arrow, for argument's sake, I asked you to be at 

17 15 degrees, I gave you half a second to be at 15 degrees, 

18 you didn't get there, I'm going to cut power to the 

19 throttle. So that's system guard one. 

20 Same system, system guard two,that's another system 

21 guard we have. This system guard check is actually in 

22 the monitor CPU. And what this system guard does it says 

23 the driver wants the throttle to be at 15 degrees and the 

24 electrical loads are asking for 2 degrees, but my 

25 throttle is not at 17 degrees. I'm going to give you two 
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1 seconds to get there. If you don't get to 17 degrees 

2 within two seconds, something has gone wrong, I don't 

3 care what's gone wrong, I don't care where it has gone 

4 wrong, you have two seconds to be there and you're not 

5 there yet. Again, same action, power to the throttle is 

6 cut. 

7 So if you look at this, it doesn't matter where the 

8 failure is. The failure could be here, the driver and 

9 electrical load could be 17, something causes the 

10 throttle request to be 25, the system guard will catch 

11 it. Or if something causes the target request to be 25, 

12 the system guard will catch it. If there's a throttle 

13 stuck condition, system guard will catch it. 

14 So any failure in all this area is caught by system 

15 guard two. Hence my analogy about the net, because 

16 that's how I like to think about this. 

17 There are individual failsafes in each of these 

18 blocks, they didn't do what they were supposed to do, and 

19 so I'm relying on my safety net. 

20 Q. Is there a third system guard? 

21 A. There's a third and final system guard. Again, the 

22 same system, and this system guard is also located in the 

23 monitor CPU. It looks at the same signals that system 

24 guard one looks at, and it says, I asked the throttle to 

25 be at 17, but you're not at 17 within half a second, the 
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main processor should have recognized that fault, it did 
not, so the main processor has failed, and so the monitor 
computer will then cut the power to the throttle. 

So again, if look at the coverage area, system guard 
three will detect for any failure in this region, or for 
any failure in the main computer that prevents system 
guard one from operating. And so in essence, system 
guard three is providing coverage in these areas. 

Q. Now, if you take all of these together, is this the 
failsafe architect that you talk about being layered? 

A. I think so. At least that's how I think about it. 

I think about it as a layered architect. And the reason 
I say is this is if we start with the same slide that we 
had before, and if we look at -- these are the main 
components, accelerator, throttle. This is how -- this 
is what the system looks like. 

There are at least 10 if not 12 dedicated failsafes 
monitoring those signals that I was telling you. There 
are at least five if not seven dedicated failsafes for 
the cruise control. The switch, if there's a problem 
with the switch. So if anything goes wrong in the cruise 
control or the accelerator pedal, I've got a failsafe for 
that. 

Once you get a driver request, if this driver. 

THE COURT: Do you need some water? 
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(Short pause. ) 

A. Just continuing. This area has again 22 failsafes 
dedicated to protect against any failure here. If I 
generate a driver request and it's 15 and something 
causes it to be 17, a copy of the driver request is kept 
to prevent that from going undetected. So I have what I 
call mirroring for this signal. 

If I look at the electrical loads, if for some 
reason everything in your car, the horn, the windows, the 
wipers, the AC, the radio, everything turns on at exactly 
the same time, the maximum it will ask the throttle to do 
is open 9 degrees, that's about 10 percent of the 
throttle opening up. 

So when the AC asks for a throttle opening request, 
it's about 2 degrees, there's a bounce check on that that 
says, I don't care what the setting is on my dial on my 
AC, you're not going to ask for more than 2 degrees. And 
then in addition all these load requests, the AC, the 
radio, the wipers, the entire list, there is the bounce 
checks on that saying, I don't care what you need, I'm 
not ever ever giving you more than 15 degrees. So 
there's individual bounds and collective bounds. 

The individual bounds are for individual loads, the 
collective bound so at 15 degrees. So this area has 
failsafes dedicated to it. 
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We talked about the system guard one a little bit 
before. It's dedicated to protect against any failure 
over here. We talked about system guard two before, 
which protects against any failure in this region. 

Doesn't matter what the failure is, doesn't matter any 
the failure occurs, any failure here is protected 
against. 

If we look at system guard three, it protects 
against any failure here and any failure in the main 
processor that prevents power from the throttle from 
being cut. The monitor CPU is checked hundreds of times 
a second by the main processor. The main processor 
asking the monitor CPU, are you alive, are you alive, are 
you alive. And if something goes wrong, the main 
processor will cut power to the throttle. So the monitor 
CPU is protected by the main processor. 

In addition, both the main processor and the monitor 
CPU I like to think of it as they have to submit a rent 
check every month to the power supply IC. Tens of times 
a second they have to tell the power supply, I'm 
alive,I'm paying rent, I'm alive. And if they don't do 
that, then the power supply IC will cut power to the 
throttle. 

So in that effect, if something fails in these two 
computers so that they don't check in with the power 
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1 supply IC, the power supply IC will just reset the 

2 processors and if you can't reset it, the engine stalls. 

3 So that's why I said that there's a layered architecture, 

4 because I have protection for each of these individual 

5 components, and in addition I have these safety nets and 

6 those safety nets protect me in the event there is a 

7 system failure that goes through my individual failsafes. 

8 There is one final failsafe that I didn't talk 

9 about, and that's what called an idle on fuel cut. If my 

10 foot is not on the accelerator and if my engine rpm goes 

11 above 2500, if for whatever reason someone opens the 

12 throttle or someone changes the source code or does 

13 whatever, if I my engine rpm goes above 2500 when my foot 

14 is not on the accelerator, the fuel to the engine is cut. 

15 So if the engine revs up, no one is pressing the 

16 accelerator pedal, it cannot rev up above 2500 rpm. 

17 That's the failsafe design there. 

18 Q. So then we covered the failsafe architecture. Now, 

19 if we go into the electronic throttle control system a 

20 little bit deeper there, start going into the software 

21 here, is there an operating system for the electronic 

22 throttle control? 

23 A. There is. There's an operating system on there. 

24 Q. Can we go to the next slide talk about the ECM 

25 functions, and then we're going to go into the operating 


THIS TRANSCRIPT IS NOT PROOFREAD 



1 


2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 

25 


74 

system. 

A. Right. This is just another depiction of what I 
showed before. We've got the accelerator pedal signals, 
we've got the throttle position signals, we're driving 
the throttle control motors, and just like I was showing 
you before, these are some of the other signals that are 
coming into the engine control module. 

The engine control module is deciding what to do 
with the throttle valve, and it's also deciding what to 
do with the ignition coils and the fuel injectors. So 
it's doing a lot of things. It's taking a lot of inputs 
and it's controlling three or more outputs. Something 
needs to schedule the computer so the computer knows what 
to do and when to do it. And that scheduler is what an 
operating system is. 

So if you think of your laptop, you've got Microsoft 
Windows, when you click on Microsoft Word and you click 
of Microsoft Excel, both of them need to use the 
computer, it's Windows that decides which one gets to use 
the computer when. And that's essentially what the 
operating system does here. It's deciding, when do I 
read the power steering signal, when do I read the 
throttle position signal, when do I send the signal to 
the throttle control motor. 

The thing to remember is, all these are happening 
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hundreds of times a second so everything is happening 
very, very quickly. And you have a processor, you choose 
a processor that's fast enough to do all this. 

Q. And is the Toyota Camry, the 2005 Toyota Camry use a 
processor that is fast enough to juggle all of these? 

A All the data I have seen suggests it's more than 
fast enough. 

Q. Can you walk us through how it schedules these 
requirements ? 

A. Sure. So think about this as your computer chip in 
your laptop, think about the operating system as Window, 
and think about these tasks as to a Microsoft product, 
for example. Word, Excel, Outlook, and stuff like that. 
The Camry, because it's a dedicated, what we call an 
imbedded system, it's preprogrammed to do a certain 
amount of things. 

The Camry has multiple tasks and they are actually 
24 tasks. So the work that the computer does is divided 
into 24 tasks. So you know, your word processing task, 
your spreadsheet task, your Outlook task. Similarly you 
have 24 tasks that the Camry main processor is doing. 

The Windows for the Camry is calls Osak, it's just 
an operating system that determines what gets run at what 
time. So this is the Windows I think of on my main 
computer. 
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MR. BIBB: Now, Your Honor I don't know 

what time you want to do the afternoon break. 

THE COURT: Now. 

MR. BIBB: But this would be an ideal 
opportunity before we go to this next area. 

THE COURT: All right. Ladies and gentlemen, 
it's five till three, we will be in recess for about 15 
minutes. Again, I'd remind you, do not discuss the case 
and do not form any opinions about the case. All rise 
while the jury exits. 

(Recess taken.) 

THE COURT: Back on the record. Mr. Arora is 
still on the stand, sir, you are still under oath. And 
Mr. Bibb, you may continue your direct exam. 

MR. BIBB: Thank you. 

Q. (BY MR. BIBB) All right. Just to recap, Mr. Arora. 
You used the analogy of the tight rope walker earlier, 
and so we've covered the failsafes, that would be 
harness ? 

A. That would be the harness and the safety nets. 

Q. And then we've got the system guards, we're got the 
nets underneath, right? 

A. Yes. 

Q. And we've covered those. Are we now to the point of 
talking about the tightrope walker and how he gets across 
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the tightrope? 

A. Yes, sir. 

Q. Now we're in the operating system. And I want to 
move through this with the jury. Can you explain how the 
operating system, you said you had all these tasks that 
you have to deal with. How does that system make sure 
our tightrope walker or walkers gets from one pole to the 
next ? 

A. I understand. So like I was saying before the 
break, there are 24 tasks that need to be performed. The 
operating system, OSEK, is responsible for scheduling 
these tasks. This is what the scheduling system looks 
like. It's -- it might be a bunch of rectangles with 
numbers, but it's actually very simple. The tasks are 
given priorities. One being the lowest priority and 20 
being the highest priority. 

And to explain this to myself I always think of a 
boarding process on the plane. So priority would be 
first class, priority 19 would be business class, 10 
would be economy class, all the way down. 

So you have these different priorities. Obviously, 
the task at priority 20, first class, gets to board the 
plane first. So if a task comes in at priority 20, it 
queues up in the first class line. It sees that there's 
no one ahead of it and then it moves into the middle 
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1 tier. So it comes into the bottom tier, which is its 

2 dedicated line. If there's no one ahead it goes right to 

3 the front of the queue. When it goes to the front of the 

4 queue, it does one other thing. It turns this digit in 

5 the top tier from zero to one. So there's a digit 

6 associated with priority 20, there's a digit associated 

7 with 19, 18, 17. Each of these 20 priorities have a 

8 digit associated with it. 

9 So when a task comes in, it moves into this priority 

10 digit. The operating system, the boarding gate agent, 

11 looks at this queue, and when it sees a one in this queue 

12 it knows that there's a task that it needs to be run. So 

13 the operating system will come in, it will see that 

14 there's a one here so it knows that there's someone 

15 waiting for it to run here. 

16 Similarly, if a business class passenger, it comes 

17 in, let's imagine it's priority 10, it comes in from the 

18 bottom, it lines up, it goes to the middle tier, and it 

19 turns the priority bit associated with that priority to a 

20 one. And the same analysis can be performed for the 

21 lower priority. 

22 So if you have situation like this, imagine this is 

23 first class, business class, economy class, the operating 

24 system will board all first class passengers, then all 

25 business class passengers, and then all economy class 
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passengers. 

The Toyota system in the real world will look 
something like this. The 24 tasks will queue up in these 
priorities, and they're queuing up in this manner, and 
queue is changing hundreds of times a second. It's 
updating, imagine this thing, the planes are being 
boarded in fast forward, for example. 

So the operating system comes in, it sees that 
there's a one on priority 20. It knows there is a task 
waiting for it, it needs to run that task. It goes and 
runs the task that's lined up here. Once it's run this 
task, the next task moves up to the front of the line and 
this bit which goes from one to zero when this task is 
run, goes back to one. So in that way all first class 
passengers are boarded first. When there's nothing left 
here, it then goes to priority 19, it runs task B, then 
task D, then B again. 

And now imagine if task C is still to be run, and 
another task at a higher priority comes in. It's then 
going to stop what it's doing with task C and run the 
higher priority task. So if you're boarding business 
class, because you boarded first class and another first 
class passenger comes in, you're going to stop the 
business class and board the first class passenger. 

And that's essentially the way this operating system 
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works. That's just the bottom line on how these tasks 
are scheduled. It's doing this very, very fast so that 
everyone boards on time and they are boarding every 
second, for want of a better analogy. 

So this is the bottom line on how the operating 
system runs the tasks and how the stuff is scheduled on 
the computers. 

Q. All right. What kind of tasks is it trying to run? 
A. There could be tasks associated with throttle 
control, there could be tasks associated with running the 
ignition coils, tasks associated with running the 
failsafes, the fuel injection, reading the brake pedal 
signal, reading the accelerator pedal signal. It's 
performing a set of functions. Those functions are 
divided into different tasks. Some tasks are more 
important than others. For example, you have to read the 
engine speed so many times a second. That's a more 
important task so it will be given a higher priority. 

So when you're designing the system you divide the 
work into tasks, you slice how much each task will take, 
and then your prioritize the task, and then you form this 
queue. 

Q. Now, we've heard the term earlier in this trial 
called memory corruption. What is memory corruption? 

A. In essence, the bottom line with memory corruption 
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1 any memory corruption, is let's take this rectangle here 

2 and let's imagine this is memory. For a computer system, 

3 and memory is just a location where you store ones and 

4 zeros. So if we have MP3s in our phones, for example, 

5 the songs will be stored as a series of ones and zeros. 

6 Memory corruption just refers to a one turning into a 

7 zero when it should not, so something causes this binary 

8 digit for argument's sake at priority 10, it's supposed 

9 to be one, but something causes it to become zero, and 

10 that's what essentially memory corruption is. 

11 Similarly, if there's a zero here, the blanks here 

12 represent zero, if those zeros become one, then that's 

13 also memory corruption. It's just a digit, or a binary 

14 digit not being what it's supposed to be. It gets 

15 corrupted. 

16 Q. Let's go to the next slide. Can memory corruption 

17 result in task death? 

18 A. I have seen no evidence to suggest that memory 

19 corruption can result in task death. 

20 Q. Have you tested a vehicle to see what the response 

21 of the vehicle is to memory corruption? 

22 A. I have. Yes. I have seen -- I've done testing and 

23 seen some of the plaintiff's expert's testing where they 

24 have not corrupted the memory but they have changed the 

25 memory. Memory corruption refers to phenomena where this 
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1 binary digit for argument's sake on priority ten, 

2 something causes it to change from one to zero. What I 

3 have seen and what I have tested is an artificial 

4 changing of this binary digit from one to zero. That's 

5 memory corruption, that's memory changing. And there's a 

6 difference between the two. 

7 Q. So all the testing that's been done has been by 

8 artificially changing the memory? 

9 A. That's correct. 

10 Q. How would you do that? 

11 A. Essentially, what the plaintiff's experts did was 

12 they took the Toyota source code and they modified it. 

13 They took the software that was written on the 2005 Camry 

14 and they changed it. They modified 228 lines of the 

15 source code. They then connected an external laptop to 

16 this too. They bypassed the memory on the computer 

17 system, the protection, the memory has protection on the 

18 computer system so that an external user cannot access 

19 it, otherwise people would be programming these cars, you 

20 know, hobbyist and stuff like that. So you have 

21 protection against that from happening. 

22 What the plaintiff's experts did was in their lab 

23 they changed the source code, they then had a third 

24 engineer fly over an install and encrypt the source code 

25 into a Camry, a test vehicle. What that allowed them to 
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1 do was access memory that's not accessible. They then on 

2 demand could change these binary digits to be whatever 

3 they wanted it to be. And they used that to artificially 

4 kill the tasks and prevent those tasks from ever running. 

5 That's my understanding of the testing that was done. 

6 Q. And you've reviewed that test? 

7 A. I have reviewed that testing and I have repeated the 

8 testing and performed a series of additional tests to 

9 characteristic the vehicle response under this artificial 

10 external modification. 

11 Q. So, have you -- so what was really happening -- 

12 strike that. Was what the plaintiffs were doing killing 

13 the task as opposed to letting it die? 

14 A. If we look at this plot again, what the plaintiff's 

15 experts did was they modified the source code so that 

16 they could write what they wanted here when they wanted. 

17 So if, for example, let's say the vehicle had this 

18 condition at any one time, they could connect an external 

19 laptop and change the bit to the way they wanted it 

20 changed. And that's my understanding of what was going 

21 on. 

22 Q. So they literally changed the source code? 

23 A They modified 228 lines of the source code, yes. 

24 Q. Is that an extensive modification? 

25 A. You know, the word extensive is subjective. Every 
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1 source code line serves a certain purpose. The addition 

2 of 228 lines of source code to a Camry does not -- it's 

3 no longer a Camry, it's some other vehicle because that's 

4 not what's being driven on the road. We don't know what 

5 additional bugs they have introduced. I know they 

6 bypassed certain interrupts. They are playing with high 

7 priority tasks. We just don't know what the vehicle will 

8 do because that's not what the software was written to 

9 do. So it's not a Camry as we would have on the road. 

10 Q. Would the testing that was done be representative of 

11 what the condition of Ms. Bookout's Camry was on 

12 September 20, 2007 as far as the software goes? 

13 A. No, it would not. 

14 Q. Now, is the testing that was done, do you consider 

15 it to be realistic? 

16 A. No, I do not. 

17 Q. Why not? 

18 A. Because, it's my understanding that the source code 

19 modification was justified as fault injection. But this 

20 is not fault injection. When you inject fault, you have 

21 to inject faults that occur in the real world. No one in 

22 the real world changes the software and writes on command 

23 different binary digits to memory. So this is nothing 

24 something that can even happen in the real world. For 

25 the plaintiff's experts to make this happen, it's my 
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1 understanding that a Toyota engineer had to fly over and 

2 help them reinstall the modified software on the Camry. 

3 Q. Now, if -- let's just say what happens when the 

4 plaintiff's expert did this fault testing and killed a 

5 task? 

6 A. It's my understanding that what the plaintiff's 

7 experts did was they tried to simulate corruption here, 

8 but that's not what their testing did. They didn't 

9 change these bits. They changed some other memory 

10 locations. 

11 Q. I'm sorry, go ahead. 

12 A. And in every single test that they ran, the throttle 

13 never opened more than where it was. It either stayed 

14 where it was until the brake was pressed, or the 

15 vehicle's engine stalled, or the vehicle went into 

16 failsafe mode. So under every single test that was done, 

17 even with this unrealistic artificial change of memory on 

18 the modified software, we did not get any throttle open. 

19 Q. Can you show that by using the next slide on the 

20 system configuration? 

21 A Right. So, I believe there's been a lot of talk 

22 about what's been called task X. Like I was saying, 

23 there's 24 tasks in the main computer. There are tasks 

24 that are controlling the ignition coils, tasks for fuel 

25 injunction, and there's what has been called task X. 
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So imagine you have 24 tasks in the main processor. 

I only showed four of them here. You have the 
subprocessor *asek, which has the monitor CPU. We've 
talked about the analog to digital converter, which is 
where the pedal and throttle signal comes in. We've 
talked about the brake switch signals coming into the 
switch input. They are then sent to the main computer, 
so the pedal signal, the throttle signal, and the brake 
switch signals are communicated to the main computer and 
to the monitor computer. 

The monitor computer does not have task. There's no 
operating system. It's just one single program running 
over and over again. Whereas in the main computer we 
have this airline boarding process. 

The different tasks in the main computer are 
responsible for reading these different signals. And 
then based on what these signals are you either control 
the throttle motor or you go into failsafe mode and you 
cut power to the throttle. 

What's critical to remember that in the system 
design is that there's only one out of the 24 tasks that 
calculates the throttle opening angle. And that's what's 
been called task X. 

Q. Can any other task -- in any other task change the 
throttle angle, other than task X? 
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A. The other tasks can transition the vehicle to the 
failsafe mode, so they can actually close the throttle, 
about the only task that has the ability to open the 
throttle is task X. 

Q. So that's why we've been focusing on killing task X? 

A. That's my understanding, yes. So task X is the only 

task that can open the throttle. Let's say the pedal is 
pressed to 15 degrees, the electrical loads are asking 
for 2 degrees, task X says I want the throttle to be open 
17 degrees. The output of task X, the 17 degrees is 
actually read by a different task. And it's this second 
task that then controls the throttle motor. 

So if you have a condition where task X is 
artificially killed as was done in this modified 
software, the output of task X becomes frozen. So if it 
was 17 degrees and then I press this button on my 
external laptop on this modified source code to kill the 
task, this is going to stay at 17 degrees. 

The second task that drives the throttle motor does 
not know that task X has died, it has no knowledge of it. 
So it continues to drive the throttle to 17 degrees. If 
I press the pedal now, nothing happens on the throttle 
because task X, which is responsible for recalculating 
the throttle is failed, it's been killed. So we're still 
at 17 degrees. 


THIS TRANSCRIPT IS NOT PROOFREAD 



1 


The way the system is designed, when I press the 


2 brake when task X is dead the brake signal STB goes from 

3 low to high. So the moment I tap the brake, I just have 

4 to hit it, I don't need to press it, as soon as I put my 

5 foot on the brake, the signal -- the stop lamp switch 

6 signal goes from zero to one. 

7 This signal is communicated both to the main 

8 processor and to the monitor processor. The way the 

9 source code in the monitor processor is written, it says 

10 the brake is telling me that I'm pressed, main processor 

11 do you cop that? That's the way the algorithm is 

12 written. 

13 The task X responsible for replying to the main 

14 process to answer this question is task X. But when we 

15 killed task X, everything in task X remains frozen. So 

16 when the brake is pressed, the monitor CPU asks the main 

17 processor, hey, I just heard the brake was pressed, did 

18 you hear the same thing? Task X which is killed replies 

19 back saying, you don't know what you're talking about, 

20 the brake is not pressed. 

21 So we have this mismatch, the high and low. The way 

22 the source code is written is the moment we have this 

23 mismatch power to the throttle is cut. And then I go to 

24 the 6.5 degrees that I was talking about. 

25 Q. How fast does it cut the throttle? 
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1 A. This throttle is cut, once this mismatch is detected 

2 for 280 milliseconds, so that's one fifth of a second, so 

3 one fifth of a second, and that's less than the blink of 

4 an eye, when this mismatch is detected, power to the 

5 throttle is cut and the throttle moves to the 6.5 

6 degrees. 

7 Q. Let me stop you right here for just a second. The 

8 testing that was done by Mr. Barr, or was done by Mr. 

9 Louden for Mr. Barr, in that testing did this occur? 

10 A. I believe in every test where task X was 

11 artificially killed tapping a brake or a transition of 

12 the signal transitioned the vehicle to the failsafe mode. 

13 Q. Have you ever seen any testing, Mr. Arora, where 

14 this failsafe did not occur when the brake switch was 

15 transitioned? 

16 A. On a vehicle with a normally working brake switch, I 

17 have not seen any test results where we don't go into 

18 failsafe mode in this scenario. 

19 Q. And you're familiar that in this case the brake 

20 switch was examined on Ms. Bookout's car? 

21 A. Yes. 

22 Q. And it operates normally, is that your 

23 understanding? 

24 A. Yes. 

25 Q. So if this were Ms. Bookout's car when the brake 
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1 switch was transitioned from on to off or off to on, what 

2 happens? 

3 A. 208 milliseconds or one fifth of a second after the 

4 task died or was killed, power to the vehicle would have 

5 been cut in that scenario. 

6 Q. Again, how often -- strike that. Have you ever seen 

7 a task X death in the real world? 

8 A. No, I have not. 

9 Q. Are you aware of anyone or any occasion that has 

10 happened, has been demonstrate to have occurred? 

11 A. No, I have not. One thing to remember here is if 

12 task X was indeed dying in the real world, the other 

13 tasks would be dying in the real world too. There's no 

14 reason that task X would be the only one that would say 

15 I'm going to die, because all the other tasks use the 

16 same memory. 

17 A number of other tasks, when they die, stall the 

18 engine. So if these other tasks are dying vehicles would 

19 be stalling all the time and that just doesn't happen. 

20 Q. I'm sorry, I interpreted you. Are you finished with 

21 that slide? 

22 A. I am, yes. 

23 Q. So what would happen if you suspended or killed off 

24 more tasks than just task X? Do you have a next slide? 

2 5 A. I do. 
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Q. Is that what you were just talking about, that you'd 
have stalling of engines? 

A. Well, it depends on which combination of tasks are 
artificially killed. But the bottom line is task X is 
the only task that calculates the throttle angle. It 
doesn't matter what other tasks they kill. If I pick a 
combination of other task that for some reason doesn't 
stall the engine, which is very unlikely, it will not 
change what the vehicle does when task X is killed. When 
task X is killed my throttle remains stuck at the last 
value. So if my throttle was at five degrees before task 
X was killed, then it would remain at five after task X 
was killed. 

And I would have the same scenario with the brake 
switch. The moment I tapped the brake switch, I would 
have this mismatch between the monitor CPU and the main 
CPU, a mismatch is a sign for the monitor CPU to 
understand that something has gone wrong and to 
transition the vehicle to the failsafe mode. So you can 
pick any combination of tasks that you want. One, the 
throttle will never open more than it was before these 
tasks are killed; and two, task X, which is only task 
that controls the throttle, when that's killed we go into 
failsafe mode. 

And I think more importantly, it's important to 
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reemphasis that this has been performed or can only be 
performed in a vehicle where the source code has been 
modified. And this is being performed on demand using an 
external tool. 

Q. So is the failsafe — and I understand this -- the 
failsafe that cuts the power to the throttle motor when 
task X is killed artificially is that located in the 
monitor CPU? 

A. That's correct. The failsafe that's doing the 
mismatch check and the monitor CPU is doing a number of 
checks, this mismatch check is only one of those checks, 
that failsafe is located physically in a separate chip. 
That's the monitor chip whose purpose of existence is to 
make sure if something like this happens in the main 
computer it's caught. It's designed that way. It's 
designed to do that. 

Q. So how does the monitor CPU go about detecting the 
death of a task, if one were to occur? 

A. If we take this example of task X death, the moment 
you have this mismatch, the high or the low with the 
brake switch, there are many checks in the monitor CPU 
with the mismatch that I showed you in the previous 
slide, the brake check will go off. 

There are other tasks that are responsible for 
reading the pedal signal. So if you can think about the 
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1 task that reads the pedal signal and when you kill that 

2 task the pedal signal is no longer being read, the 

3 monitor CPU will still read the pedal signal and it will 

4 ask the main CPU, hey, I just found out the accelerator 

5 pedal is at 15 degrees, do you concur. And because we 

6 kill that task in the main CPU, the response will be, you 

7 don't know what you're talking about, it's still at idle, 

8 because the task id dead. 

9 And in that case, the pedal check will work. So 

10 just like we had the brake check working before, if you 

11 kill the pedal task, the pedal check will work. And what 

12 will happen is one of these — the faults will turn on 

13 and power to the throttle will be cut. 

14 What we also happen is when power to the throttle is 

15 cut, if failsafe will be stored in memory. So the check 

16 engine light will come on, and a code will be stored in 

17 memory. So this task is killed, I have the ability to go 

18 up to the vehicle afterwards, read what error is stored, 

19 and the error is -- for example, for the pedal check, it 

20 will as PO606. I can read that error and find out why 

21 that error was triggered. And if that error is being 

22 triggered because the task death, I have the ability to 

23 find that out later on. 

24 Q. So we would have some sort of diagnostic trouble 

25 code or DTC stored? 
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1 A. That's right, yes. 

2 Q. Would the check engine light be set on the next time 

3 the car is started? 

4 A. Yes, it would be. 

5 Q. And are you familiar with whether there were any 

6 trouble codes found on Ms. Bookout's car after the crash? 

7 A. As far as I understand, there were not. 

8 Q. Now, you mentioned earlier that you did some testing 

9 on vehicles to characterize vehicle response to task 

10 death, is that right? 

11 A. Yes, we ran, I guided the testing that was run by a 

12 set of engineers in Phoenix. We ran 150 odd tests to 

13 characterize the various task death scenarios. 

14 Q. And did you make some videos of those? 

15 A. Each of the tests had a video recording of it. 

16 Q. You made how many tests? 

17 A The number I don't remember but it would be around 

18 150 or so. 

19 Q. Let's look at one, okay? Can we see the video? I 

20 think you have to go to the next slide. Would this be 

21 when task X is killed? 

22 A. In this test we actually speed up the vehicle to 70 

23 miles per hour, simulating Ms. Bookout out on the 

24 highway. We then simulate the artificial killing of task 

25 X on the modified source code and document the response 
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1 of the vehicle. 

2 Q. The gauges we're looking at, we have the temperature 

3 gauge, the tachometer and speedometer and then the fuel 

4 gauge going left to right? 

5 A. That's correct. 

6 Q. Is this car being driven on the road? 

7 A. This is driven on our track in Phoenix. That's when 

8 task X was just killed and the vehicle remains where it 

9 is but the tachometer actually dies when this task is 

10 killed. 

11 Q. The temperature gauge? 

12 A. Sorry, the temperature gauge, yes. And the moment 

13 the brake is hit we go into failsafe mode and three 

14 seconds later the scenario the engine actually stalls. 

15 Q. And we see the oil light and the battery light come 

16 on? 

17 A. That's correct, yes. And also very often we 

18 actually have to disconnect the battery and reconnect it 

19 to restart it because if the fault occurs and if the 

20 engine is stalling, then we lose the ability to start it. 

21 Q. And if the car was able to be restarted you would 

22 then have the check engine light on when it restarts? 

23 A. Yes. 

24 Q. And did this happen every time when you ran one of 

25 these tests? 
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1 A. I have single time task X was killed on its own or 

2 in combinations with other task, depending upon the order 

3 in which the task was killed, either we got the engine 

4 stalling, or we had failsafe mode transition. 

5 Q. Now. Let's go to -- we're almost at the end here. 

6 We've looked at task X and what happens when it's killed. 

7 What would happen, have you analyzed what would happen if 

8 task X died or was killed at the time Ms. Bookout is 

9 driving down the exit ramp to Texanna Road on September 

10 20 , 2012 ? 

11 A. I have, yes. 

12 Q. Can we see the next here. 

13 A. So the way I see it, is Ms. Bookout had testified 

14 that she was going on the highway at the posted speed 

15 limit, which is about 70 miles per hour, and she had 

16 successfully slowed down to get to the off ramp. Now, 

17 there are three possibilities that are relevant for task 

18 death. Possibility one is her foot's on the accelerator 

19 pedal when the task dies. Now, if her foot is on the 

20 accelerator pedal when the task dies, the throttle will 

21 remain at the last value, and then the moment she hits 

22 the brake, the moment she taps the brake or puts her foot 

23 on the brake, immediately go into failsafe mode. 

24 So from where I stand from my analysis, it's not 

25 possibly for the task to have died with her foot was on 
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the accelerator pedal. 

Possibility number two is she's on the off ramp and 
her foot's not on either pedal. She isn't hitting the 
accelerator, she isn't hitting the brake. The moment she 
releases her foot from the accelerator pedal, about 50 
milliseconds later, one twentieth of a second later, the 
throttle goes to idle. So while her foot is on neither 
pedal, the throttle is at idle. Remember idle is about 2 
degrees throttle opening. 

In addition, when she hits the brake pedal to stop 
the vehicle, she'll go into failsafe mode. So that's 
possibility number three — possibility number two. 

Possibly number three is her foot's actually on the 
brake pedal when the task dies. When her foot is on the 
brake pedal, when she's slowing down the vehicle, my 
throttle is again at idle. So even if I don't have a 
brake switch transition because she doesn't remove her 
foot from the brake pedal which I need for the 
transition, the throttle would be a idle, 2 degrees. And 
again, that's not consistent with what happened in this 
incident. 

So in my mind, these are the only three combinations 
that we can have with the driver. I know what happens in 
these three combinations when task X, which is the only 
task that controls the throttle is killed. And so the 
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1 conclusion is task death, whether individually or task X 

2 or any combination cannot possibly explain what happened. 

3 Q. I want to just ask you a couple of questions about 

4 this. So if we've got our foot on the accelerator pedal, 

5 whatever opening the throttle is, if the task were to 

6 die, let's say it's at -- we looked at some testing from 

7 Mr. Stopschinski. And as he's driving along at 70 miles 

8 an hour, it's somewhere between from 15 and 20 percent 

9 open. So at that point that's where the throttle would 

10 stick at 15 to 20 percent, is that right? 

11 A. Until the brake is pressed. 

12 Q. Until the brake is pressed. And how fast after the 

13 brake is pressed will the -- would the failsafe go into 

14 action? 

15 A. Within 200 milliseconds, one fifth of a second 

16 approximately, power to the throttle is cut. 

17 Q. Can power come back to the throttle? Can she go 

18 back to the gas and cause the vehicle to accelerate? 

19 A. No, she cannot. The way the system is designed, 

20 once the power is cut, once you have failsafe mode, you 

21 actually have to either disconnect the battery 

22 altogether, or you have to clear the failsafe mode for 

23 the power to be reinstated to the throttle. 

24 Q. And would that be present after the crash? 

25 A. Would what be present? 
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1 Q. This failsafe? 

2 A. The failsafe would be stored unless someone removed 

3 the car's battery for an extended period of time. 

4 Q. Now, let's take a look at number two. If she is on 

5 the brake, how long does her foot have to be off the 

6 throttle for the throttle to close? 

7 A. My testing has shown it's about 50 to 70 

8 milliseconds, which is about one 20th of a second. 

9 Q. If her foot is off the accelerator pedal for one 

10 20th of a second, we go into idle, which is how much of a 

11 throttle opening? 

12 A That's -- depending what's on in your vehicle, air 

13 conditioner, radio, whatever is on, typically it's around 

14 2 to 4 degrees. 

15 Q. Would it be the same as if I'm pulling up to the 

16 corner here of Harvey and Park with my foot off the 

17 accelerator pedal putting my foot on the brake? 

18 A Depends on if your air conditioning is on here or 

19 not, but approximately. 

20 Q. How about today? 

21 A. It would be the same, yes. 

22 Q. Now, is it true that if she kept her foot on the 

23 brake that whole time and never took her foot off the 

24 brake, would the car remain in this stuck throttle 

25 situation until she ran out of gas? 
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A. I believe the car would have slowed down much before 
we got into that situation. 

Q. Because the car is running at what? Idle. 

A. It's running at idle, yes. 

Q. Not at wide open throttle? 

A No, it's typically 2 to 4 degrees throttle opening. 
Q. And you think your leg would wear out or get tired 
before you ran out of gas? 

A. I haven't done the experiment, but I wouldn't be 
surprised if it did. 

Q. I should know better than to ask that of a 
scientist. And now when your foot is on neither pedal 
where is the throttle? 

A. The throttle again about 15 milliseconds, one 20th 
of a second after I remove my foot from the accelerator 
I'm at idle. 

Q. And then once your foot is on the brake pedal, what 
happens ? 

A. If your foot is on neither pedal and you hit the 
brake pedal when you kill task X, 200 milliseconds later 
a fifth of a second later, power to the throttle is cut. 
Q. I have one last thing I'd like to ask you about and 
that is, MISRA. Can we see the next slide. What is 
MISRA? 

A. My understanding of MISRA is it's an organization 
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based in the United Kingdom that has published a set of 
guidelines. The guidelines were first published in 1998. 
The steering committee that published these guidelines 
was lead, if that's the right word, by an engineer from 
Jaguar. And the way I understand it, is a number of 
engineers, predominately in the British automotive 
industry got together to publish this series of 
guidelines. 

Q. Now, this website is that an United Kingdom website? 
A. This is how I accessed information about MISRA and 
this is what the web page is, and based on how I 
understand how these things are, it's based in the United 
Kingdom. 

Q. And who are members of MISRA? 

A. This information was pulled a few weeks ago, so it's 
quite current. These are the current members of MISRA, 
so I've go Bentley, Ford, Jacquard, Land Rover, Lotus and 
a couple of other organizations that I'm not familiar 
with. 

Q. All right. Let me ask you based on your research 
and into it and your familiarity, who are not members of 
MISRA? Is General Motors a member of MISRA? 

A. Based on what I see on their website, the answer is 
no. 

Q. Is Chrysler a member of MISRA? 
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1 

A. Again, based on the information I have, no. 

2 

Q. Is Mercedes Benz a member of MISRA? 

3 

A. Same answer, sir. 

4 

Q. Is Honda a member of MISRA? 

5 

A. Not as per my understanding. 

6 

Q. Is Nissan a member of MISRA? 

7 

A Same answer, sir. 

8 

Q. Is Masda a member of MISRA? 

9 

A. Again, not from my understanding. 

10 

Q. Is Volkswagen a member of MISRA? 

11 

A. Same answer, sir. 

12 

Q. Is Audi a member of MISRA? 

13 

A. Same answer, sir. 

14 

Q. Is Kia a member of MISRA? 

15 

A. Not per my understanding. 

16 

Q. Hyundai? 

17 

A. Again, not from my understanding. 

18 

Q. In fact, the only members that are listed by then. 

19 

Bentley, Ford, Jaguar, Land Rover and Lotus. 

20 

A. That's how I read it, yes. 

21 

Q. And, I think even Mr. Barr agreed there were only 

22 

five automakers who were members, and would those be the 

23 

f ive ? 

24 

A. I don't know if these five what he was referring to. 

25 

I've seen some testimony from individuals that say only 
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five automotive manufacturers follow MISRA. I believe 
these are the five they were talking about, but I don't 
know if all these members follow MISRA. 

Q. And back in the late 90s was Jaguar and Land Rover 
owned by Ford Motor Company? 

A. As far as I understand. 

MR. BIBB: One moment. Your Honor. Mr. Arora, 
I appreciate it. I think Mr. Portis has some questions 
for you. 

MR. PORTIS: May it please the Court. 

THE COURT: Yes. 

CROSS-EXAMINATION 

BY MR. PORTIS: 

Q. Is there Dr. or Mr? 

A. It's Mr. 

Q. And Mr. Arora, you work for a company called 
Exponent, I think we heard that? 

A. Yes, I do, sir. 

Q. I want to go through a little bit of the history of 
Exponent and their involvement in the Toyota unintended 
acceleration cases, okay? 

A. Sure. 

Q. Now, this particular case was filed when? 

A. The Bookout case? 

Q. Yes. 
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1 A. I believe it was 2009, but I don't remember exactly. 

2 Q. If I said 2008, you'd be okay with that? 

3 A. Sure. 

4 Q. When did the wreck happen? 

5 A. 2007. 

6 Q. 2008, this case was filed, is that right? 

7 A. If you say so, yes. 

8 Q. Now, I understand that Exponent was hired by Toyota 

9 in late 2009, am I correct? 

10 A. I think so, although I don't know the exact time 

11 frame. 

12 Q. Was it in December, or do you know? 

13 A. I would not know. 

14 Q. And what was Exponent hired to do? 

15 A. I have no idea what you're talking about, sir, so I 

16 don't know. 

17 Q. You don't know what -- you don't know what Exponent 

18 was hired to do by Toyota in late 2009? 

19 A. I know we had a public report effort. 

2 0 Q. What? 

21 A. A public report that was published by Exponent, I 

22 presume that's what you're talking about, but if you can 

23 give me more specifics about what you're talking about. 

24 Q. When was the public report? 

25 A. I believe it was issued sometime last year. 
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1 Q. Last year. So beginning in late 2009 they worked on 

2 a public report that was submitted late last year? 

3 A. I don't know the time frames, I wasn't managing that 

4 project, so. 

5 Q. Now, we know in February of 2010 Mr. Lentz testified 

6 before Congress, is that right? 

7 A. If you say so. 

8 Q. Well, have you read his testimony? 

9 A. i don't believe I have. 

10 Q. I haven't read the president of Toyota's testimony? 

11 A. I don't believe I have. 

12 Q. Before Congress? 

13 A I don't believe I have. 

14 MR. BIBB: Objection, this is really going 

15 beyond the scope of anything he's testified. 

16 THE COURT: Overruled. Go ahead. 

17 Q. (BY MR. PORTIS) Now, in February, 2010, did you 

18 realize that Mr. Lentz told the American public that 

19 there was nothing wrong with the electronic throttle 

20 control or the electric system on the Toyota vehicles, 

21 did you know that? 

22 A. Since I haven't read his testimony; I would have no 

23 way of knowing that. 

24 Q. No, you know at that particular time and you can 

25 tell me if I'm wrong, there had been no testing done by 
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1 Exponent to make that claim, is that correct? 

2 A. Again, sir, I wasn't managing the project so I 

3 wouldn't know what was done after we were retained by 

4 Toyota. 

5 Q. Fair enough. Have you seen that testing, any 

6 testing done for prior to February 2010? 

7 A. I know there's a report from early 2010 which had 

8 some testing, I don't know when in 2010 it was released. 

9 Q. What was that testing? 

10 A. I believe there was some testing done on resistor 

11 faults in accelerator pedals is my recollection. 

12 Q. If I was to tell you that there had been no testing 

13 done by Exponent to confirm Mr. Lentz's public comments, 

14 would that surprise you? 

15 A. I have no way of knowing either way, so. 

16 Q. But we do know this, that Mr. Lentz told the 

17 American public that there was no relation to the 

18 electronic throttle control in the sudden accelerations 

19 that were occurring in this country, is that right? 

20 A. I haven't heard his testimony, sir, so whatever you 

21 say. 

22 Q. Now, tell us when you were hired? 

23 A. In this matter? 

24 Q. Well, just in your -- in the first time you were 

25 hired by Toyota to do any work related to unintended 
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1 acceleration? 

2 A. I was retained personally on the case, it would have 

3 been early last year is my recollection. 

4 Q. Early 2000 and what? 

5 A. '12, best of my recollection. 

6 Q. Early 2012. And then you went through and you 

7 looked through some source code, am I right about that? 

8 A. For the cases that I was hired for those particular 

9 vehicles, yes. 

10 Q. You looked at the source code for vehicles? 

11 A. I believe my first engagement was for the Van Alfen 

12 and -- for the Van Alfen matter and there was source code 

13 provided for a number of vehicles. There were the 

14 Camrys, and again, I'm going off memory, there were a 

15 number of years Camrys, I believe it was either Tacoma or 

16 the Tundra and a couple of other model year vehicles. 

17 Q. You don't remember what those are? 

18 A. Sitting here unfortunately I don't. 

19 Q. But you do remember the Camry and the Tacoma and the 

20 Tundra? 

21 A Tacoma or Tundra, I always get them mixed up. 

22 Q. So that would have been early in 2012 you looked at 

23 the source code for the Camry and Tacoma and Tundra, 

24 right? 

25 A. Yes. 
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1 Q. Are there millions of upon millions of source code 

2 lines for those vehicles? 

3 A. I don't know if it's millions upon millions, but 

4 it's a fair amount. 

5 Q. Is it millions? 

6 A. I haven't counted them, but it's a fair amount. 

7 Q. Did you look at each of the source codes of the 

8 entire vehicle? 

9 A. No, I did not. 

10 Q. Now, prior to your involvement in early 2012, was 

11 there anyone else at Exponent that you knew was working 

12 on UA matters? 

13 A. I believe there was a team at Exponent that was 

14 working on this. 

15 Q. A team was? 

16 A. Yes. 

17 Q. Do you know who they were? 

18 A. I know I was one of the team members. 

19 Q. So does that mean you were working on it before 

20 early 2012? 

21 A. For the public report matter, yes, I was one of the 

22 team members. 

23 Q. Well, that's my question, sir, when did you first 

24 start working on the unintended acceleration matter? 

25 A. I thought your question was when did I get hired to 
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1 work on it, was the misunderstanding. 

2 Q. Well, you got paid for your work that you were 

3 working on prior to 2012, didn't you? 

4 A. I'm sure the company got paid. I was part of a team 

5 that was reporting to a project manager for the public 

6 report effort. There were a bunch of us in that team. 

7 Q. And you turned in your hours, right? 

8 A. Sure. 

9 Q. And the company would be paid for your hours? 

10 A. I'm sure they would have been, yes. 

11 Q. And so you were part of a team working on the public 

12 response? 

13 MR. BIBB: Objection, misstates -- 

14 THE COURT: Overruled. You can answer. 

15 THE WITNESS: I was part of the team that was 

16 working on the nonlitigation effort to review the Toyota 

17 system. 

18 Q. (BY MR. PORTIS) And how many people were on that 

19 team? 

20 A. There were lots of us, so, I couldn't tell you 

21 because there were people looking at the pedal design, 

22 people looking at EDR, electromagnetic interference, I 

23 was focused on the software and hardware of the throttle 

24 control, so as far as how many overall people that worked 

25 on it, I would have not the slightest clue. 
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Q. Would it be more than 20 engineers? 

A. I have no number I can give you. 

Q. You just know it was a team? 

A. It was a team, yes. 

Q. And you were a part of that team. So when did you 
become a part of that team? 

A. It would have been mid 2010. 

Q. Mid 2010? 

A. Yes. 

Q. And so from mid 2010 up until early 2012, you had 
already been working on Toyota unintended acceleration 
issues? 

A. I was working on reviewing the throttle control 
system, yes. 

Q. Is it fair to say that your public response, your 
being Exponent, public response that was issued last 
year, went back and said, you know what, even though 
Mr. Lentz didn't have any information, what he said back 
in February 2010 is correct, the electronic throttle 
control is not involved in unintended acceleration? 

A. I don't know how to answer that because I wasn't 
involved in the forming the public response. I know 
there was a report issued last year but if there were 
other interim reports, I don't know if those were issued 
or not. 


THIS TRANSCRIPT IS NOT PROOFREAD 



Ill 


1 Q. And so the work that Exponent did for Toyota, the 

2 work that Exponent did for Toyota after the fact 

3 confirmed what Mr. Lentz said before the fact, right? 

4 A. Again, I have no way of answering that because I 

5 don't know the timing of the releases. 

6 Q. That's fair enough. Let me ask it this way, did the 

7 public response say that the electronic throttle control 

8 was not involved in unintended acceleration? 

9 A. I don't know if it said it exactly like that, but I 

10 believe we couldn't find anything that caused UA in these 

11 vehicles. 

12 Q. And you haven't found that in all of your 

13 testimonies, correct? Testimonies you've provided in 

14 this case? 

15 A. Yeah, I have not, no. 

16 Q. So is it fair to say that the result had already 

17 been predetermined before Exponent was ever involved and 

18 did any testing in the case? 

19 A I have no way of answering that, because my role was 

20 to look at the software and find out if there was 

21 something wrong. What happened at other levels, I don't 

22 know. 

23 Q. Now, we heard in Dr. Young's testimony the fact that 

24 Exponent has been paid a great deal of money by Toyota, 

25 is that right? 
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1 A. That's what I heard this morning, yes. 

2 Q. So you knew that before today, didn't you? 

3 A. I didn't know the numbers precisely, no. 

4 Q. And is it fair to say that from 2003 to 2013 that 

5 Exponent has been paid 42 million by Toyota? 

6 A. Again, I heard numbers like that from Dr. Young's 

7 testimony, during his testimony this morning, so if those 

8 are the numbers, those are the numbers. 

9 Q. And actually from 2010, when you got involved, 2013, 

10 the middle of 2013, Exponent had been paid $33 million, 

11 is that right? 

12 A. Sounds about right, I don't know the exact numbers. 

13 Q. Now, you talked about your work. Did you have a CV? 

14 A. I do, yes. 

15 Q. Now, and is that an exhibit in the case? 

16 MR. BIBB: Don't ask me. 

17 THE COURT: It hasn't been admitted nor offered 

18 as an exhibit. I think it was on the screen though 

19 earlier, wasn't it? 

20 MR. BIBB: No, not his. 

21 Q. (BY MR. PORTIS) Well let's talk about your 

22 background a little bit, okay. If I hear you right you 

23 got your master's degree from Perdue University, right? 

24 A. Yes. 

25 Q. And following your degree at Perdue University you 
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went to work with Exponent? 

A. Yes. 

Q. And so your whole professional life has been with 
Exponent, is that right? 

A. I did a job for two months when I transitioned from 
my bachelor's degree to my master's degree, I had a two 
month gap and I actually worked at the place where I had 
interned during my bachelor's degree, so that would be 
additional experience I've had. 

Q. And if I wasn't clear, I'm sorry, I was just asking 
from the time you received your master's degree at 
Perdue, since that time I've got your job, your 
profession work has been at Exponent? 

A. You're right, sir. 

Q. And while you've been at Exponent, I think my 
information is correct if I can remember your CV 
correctly, you've dealt with Lithium batteries issues, is 
that right? 

A. That's been something I've worked on, yes. 

Q. You've done a lot of lithium battery work? 

A I wouldn't say a lot of it. I've done a number of 

projects on it, yes. 

Q. You've also done some work to try to figure out some 
cause of fires in recreational vehicles, is that right? 

A. That was a case that I worked on, just a couple of 
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1 cases, I believe, yes. 

2 Q. Because I think you've only worked in four cases, 

3 correct? 

4 A. Four or five, yes. 

5 Q. And it's fair to say that there are other members of 

6 Exponent who have more -- well, let's just be blunt, that 

7 they have more experience in software development, is 

8 that fair to say? 

9 A. I wouldn't be surprised if there are. 

10 Q. And they certainly have more experience in imbedded 

11 software, correct? 

12 A. Again, I wouldn't be surprised if there are. 

13 Q. Most of -- I think if I'm right, most of your 

14 publications that you've given on your CV, they relate to 

15 batteries, right? 

16 A. Yes. And the reason for that is because when we 

17 work on source code issues, or we work on other circuit 

18 design issues, we are retained by clients who give us 

19 access to their confidential source code and their 

20 confidential designs. We have to sign confidentiality 

21 agreements, so we can't just go and publish this stuff. 

22 The only thing we can publish is stuff we can do research 

23 and experiments on. 

24 Q. And I understand -- 

25 A. So that's why you don't see the publications of 


THIS TRANSCRIPT IS NOT PROOFREAD 



115 


1 software and hardware in my CV, because I'm just not 

2 allowed to publish that kind of information. 

3 Q. And all I asked is the publications that you have 

4 had relate to batteries, right? 

5 A. Like I said, because that's the only thing I'm 

6 really allowed to publish so. 

7 Q. Have you had any publications on software and 

8 electronic throttle control systems? 

9 A. On electronic throttle controls, I have not. 

10 Q. What experience do you have on your CV to reflect 

11 your expertise in software and imbedded systems? 

12 A. Well, both my undergraduate and master's degree have 

13 involved significant components of software, hardware and 

14 imbedded systems? 

15 Q. Did you say your undergraduate degree? 

16 A. My bachelor's degree, yes. 

17 Q. In Australia? 

18 A. Yes, sir. And in addition I've worked on a large 

19 number of projects directly involving imbedded systems 

20 where I've been retained to either review what the 

21 imbedded system is doing to make sure it works properly, 

22 or to find out why it's not doing what it's supposed to 

23 do. And I've also gone on audits of manufacturing 

24 facilities where they make these imbedded systems to see 

25 if something during the manufacturing process could be 
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introducing latent problems that may rear its head later 
on in the field. So that's the other type of work that 
I've done. 

Q. Thank you. Let me ask you this, have you made any 
publications on election control modules in automobiles? 
A. No, I have not. 

Q. Electronic throttle control systems in automobiles? 

A. No, I have not. 

Q. Accelerator pedal hardware or circuitry in 
automobiles ? 

A. No, I have not. 

Q. Wiring and connectors for electronic systems in 
automobiles ? 

A. I believe I have a publication that may be something 
like what you're talking about. We had done in research 
experiment to characterize the arch faults that may occur 
in vehicles, and also to find out what the shorting 
currents would be, again, because this is an experimental 
type project that doesn't involve client confidential 
data, we can publish on materials like that. So I do 
have a publication on that, I believe. 

Q. What about software fault testing in automobiles? 

A. Again, no, because that would be confidential 
information. 

Q. Have you worked a software fault testing in 
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1 automobiles? You've never told us that before. 

2 A. Not in automobiles, but other systems. 

3 Q. What about electronic hardware fault testing in 

4 automobiles? 

5 A. Again, if you would consider the wiring faults and 

6 the arch fault testing as electronic faults, then I do 

7 have a publication on that. 

8 Q. Now, let me ask you this. We talked about there are 

9 some senior software engineers there in -- at Exponent? 

10 A. I'm sure there are. 

11 Q. Well do you know Dave Henning? 

12 A. I don't think I do. The name rings bell but I don't 

13 know who he is. I can't put a face to a name. 

14 Q. He's was a senior software development for Exponent 

15 in Phoenix. You don't know Dave Henning? 

16 A. I really don't, no. 

17 Q. Do you know if he helped in any way with examining 

18 or testing Toyota ECM systems? 

19 A. I don't know who he is, so. 

20 Q. That's fair enough. Do you know John Koerhing, 

21 K-O-E-R-H-I-N-G? 

22 A. I can't say I do, no. 

23 Q. And he's currently a senior software development at 

24 Exponent in Phoenix? 

25 A. If he belongs to our technology development 


THIS TRANSCRIPT IS NOT PROOFREAD 



118 


1 practice, then they have a separate area which requires 

2 security clearance. We're not allowed to go in this 

3 area, so if there are engineers that are in that group 

4 and I don't know about those engineers, I wouldn't be 

5 surprised because we're separate parts, restricted parts 

6 of the building because they are working on military 

7 related stuff. 

8 Q. And you're not -- you're not allowed to go into 

9 those areas? 

10 A. I don't believe -- there is certain areas that I'm 

11 not allow to go into, yes. 

12 Q. But you do work in the Phoenix office, correct? 

13 A. I do, yes. 

14 Q. You said that you reviewed the expert reports of Mr. 

15 Barr, right? 

16 A. I did, yes. 

17 Q. And you reviewed the expert reports of Dr. Koopman, 

18 right? 

19 A. Again, maybe I need a clarification. These reports 

20 were for the Saint John matter, are those the reports 

21 you're referring to? 

22 Q. I don't -- if that's what you reviewed? 

23 A. Those are the ones that I've looked at, yes. 

24 Q. Can you recall roughly much imbedded systems 

25 experience each of them has? 


THIS TRANSCRIPT IS NOT PROOFREAD 



119 


1 A. I don't remember. 

2 Q. Well, does 20 years of experience in imbedded 

3 systems for Mr. Barr sound about right? 

4 A. If it is, it wouldn't surprise me. 

5 Q. Does 25 years for Dr. Koopman sound about right? 

6 A. Again, if it is, it wouldn't surprise me. 

7 Q. Would it be fair to say that their involvement in 

8 imbedded systems is significantly more than your 

9 experience in imbedded systems? 

10 A. I guess if those numbers right, then yes. 

11 Q. Now, I want to look a little bit about -- when we 

12 talk about Toyota and we talk about their imbedded 

13 system. And I think you said you think this is an 

14 imbedded system. But it is an imbedded system, right? 

15 A. It is an imbedded system, yes. 

16 Q. Did you talk to the Toyota engineers who developed 

17 this software? 

18 A. I have talked to some Toyota engineers at various 

19 times, whether they developed the software, I don't know 

20 if they were actually writing the software code. I know 

21 they were knowledgeable of the code. 

22 Q. And you were hired by Toyota, right? 

23 A. Exponent was retained by Toyota, yes. 

24 Q. You're an employee, right? 

25 A. Yes. 
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Q. I think you're a principal of some sort? 

A. I am a principal, yes. 

Q. And you had access to anyone you wanted to at 
Toyota, right? 

A. That's not true, no, I did not. 

Q. I mean, if you called up and couple and said, hey, 
listen, I'd like to talk to these guys or these girls who 
developed the software in this car, I'd like to talk to 
them, I want to see what's going, you could have done 
that, couldn't you? 

A. I couldn't. I didn't know who counsel -- which 
counsel was working with Exponent. I didn't have that 
visibility. 

Q. Well, you knew who Toyota counsel was in the Van 
Alfen case, right? 

A. In the Van Alfen case, yes. 

Q. You know who it is in the Saint John case, right? 

A. Yes. 

Q. You know who it is in our case, right? 

A. Yes. 

Q. You know Mr. Bibb, don't you? 

A. I do, yes. 

Q. Did you ever get on the phone and say, hey, Mr. 

Bibb, I want to talk to the Toyota engineers who 
developed the software? 
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1 A. I don't think I have, no. 

2 Q. You never made that request? 

3 A. I never needed to make that request. 

4 Q. I understand, I'm just asking if you made the 

5 request? 

6 A. Yes, no. 

7 Q. You hadn't seen any testimony, have you, of any of 

8 those Toyota software engineers who come in and say, hey, 

9 listen, this is the way they designed the system, this is 

10 how we designed the system, have you read any of that 

11 testimony? 

12 A. I believe I've seen some testimony from Toyota 

13 engineers, there's Ishii is one, he's one of the software 

14 leads or managers, I've seen his testimony. 

15 Q. So you did see Mr. Ishii's testimony? 

16 A. Yes, I did. 

17 Q. Do you know if any of those Toyota engineers who 

18 developed the software are coming to testify or not? 

19 A. I couldn't tell you. 

20 Q. But you're coming to testify and defend Toyota's 

21 system, right? 

22 A. I'm here, yes. 

23 Q. Very good. Now, let's talk a little bit about what 

24 you say. One of the things you say initially is that 

25 there is no realistic fault in hardware or software. Did 
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1 I read that correctly? 

2 A. I think so, yes. 

3 Q. What is realistic? 

4 A. The reason I use the word realistic is because there 

5 have been some demonstrations by some experts or 

6 professors where they have artificially modified the 

7 circuit. I've seen a report from a professor who 

8 actually added an additional circuit between the throttle 

9 and ECM. I have seen some testing by another expert who 

10 took additional resistance boxes and rewired the 

11 accelerator pedal. 

12 So when I was using the word realistic, I was using 

13 the word to signify something that actually can happen in 

14 the real world, versus something that someone has 

15 redesigned the circuit or changed the software. 

16 Q. So is that a scientific word, realistic? 

17 A. I think so, it is yes. 

18 Q. Okay. But the definition is that it's something 

19 that can happen in the real world, right? 

20 A. That was my definition, yes. 

21 Q. Let's talk about stuff that happened in the real 

22 world. How many -- how much testimony have you read 

23 about incidents where people say my car is surging, how 

24 much of that testimony? 

25 A. Not a lot, really. 
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1 

Q. How much testimony have you read where people said. 

2 

you know what, my car is out of control? 

3 

A. Again, not a lot, really. 

4 

Q. How much testimony have you read where someone said 

5 

my car is accelerating and I have no control over my car? 

6 

A. Again, not a lot, really. 

7 

Q. So wouldn't you say that's real world? 

8 

A. Maybe what vehicle is doing is real world. My scope 

9 

of work here was to focus on the design of the throttle 

10 

control system and see if the throttle control could fail 

11 

in a manner that could cause the vehicle to experience 

12 

UA. I wasn't asked to do any root cause analysis, and I 

13 

didn't do any root cause analysis. I just looked at the 

14 

electric throttle to see if that can explain the 

15 

incident. 

16 

Q. Now, you understand that back in 2003, 2004. 

17 

MR. PORTIS: Judge, may I approach? 

18 

(THE FOLLOWING PROCEEDINGS WERE HAD AT THE BENCH 

19 

OUTSIDE OF THE HEARING OF THE JURY.) 

20 

MR. PORTIS: I was about to use the word 60,000 

21 

in relation to surge, in relation — 

22 

MR. BIBB: He doesn't know anything about it. 

23 

MR. PORTIS: I'm talking about real world 

24 

stuff. 

25 

MR. BIBB: I object on the grounds of surge is 
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1 not UA. That has been ruled out, as you know. 

2 THE COURT: I don't think I have. 

3 MR. BIBB: It should not be considered because 

4 it's not something like what we have in this accident for 

5 sure. 

6 MR. PORTIS: Ms. Pries-Morrison repeatedly used 

7 the word surge. The document Toyota offered uses the 

8 word surge. 

9 THE COURT: I'm going to overrule that 

10 objection. 

11 (THE FOLLOWING PROCEEDINGS WERE HAD AT THE BENCH 

12 OUTSIDE OF THE HEARING OF THE JURY.) 

13 Q. (BY MR. PORTIS) When we talk about real world, I 

14 mean, if you wanted to find out what happens in the real 

15 world, you need to go to what's going on in the real 

16 world, right? 

17 A. I'm looking at the hardware and software design, and 

18 I'm looking at how that can fail in the real world. So 

19 as far as my focus is concerned, it's on the electronic 

20 throttle system, and that's what I'm focused on. 

21 Q. Well, let's talk about the real world. Back in 

22 2003, were you aware that if you typed in the word surge, 

23 which is a word that has been used by some of these 

24 people who have had these unintended accelerations, if 

25 you type in the world surge that there' 60,000 complaints 
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1 that come up? 

2 A I didn't know that. 

3 Q. Does that real world matter to you? 

4 A. Well, if it's 2003, it's a different vehicle. We're 

5 focusing on the 2005 Camry, so I don't see how it would 

6 matter to me for this case. 

7 Q. In the same generation? 

8 A. It might be, but I'm sure there are differences. 

9 Q. Now, is it real world where these — this 

10 information that goes into NHTSA -- you know what NHTSA 

11 is, don't you? 

12 A. I do, yes. 

13 Q. Is it real world where people call in, write in and 

14 say, hey, listen, my car is unintended acceleration have 

15 occurred and it is out of the control, I can't do 

16 anything about it, I'm pressing the brake and it's still 

17 going, is that real world? 

18 A. I'm sure it is, but we need to be careful because 

19 from personal experience I have a number of projects 

20 where I work with clients, and I have a client that makes 

21 the Toy RC planes, as you can imagine, you put a battery 

22 in, the thing starts rotating for 10 minutes -- for 10 

23 seconds you fly it and something you buy for five 

24 dollars. Similar to the NHTSA database, there's a CPSC 

25 database, and a few weeks ago someone had complained that 
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1 this small toy in CPSC database has caused a smoke alarm 

2 to go off and it caused the fire sprinkler to come down. 

3 So my client came to me and said, how can this 

4 product cause this. And the product could just possibly 

5 not cause because there is no radio transmission in it, 

6 and that's the only thing that could have caused the 

7 sprinkler to go off. 

8 My point being, I have not studied the NHTSA 

9 databases, but I've looked at other similar databases, 

10 and we need to be careful and do a proper review of these 

11 complaints before jumping to any conclusions. And even 

12 though I haven't looked at the NHTSA database, I would 

13 just be careful when jumping to conclusions without doing 

14 any analysis. 

15 Q. I guess to use your analogy of this person who is 

16 complained about some -- did you say five dollar? 

17 A. Five or nine dollar toy, yes. 

18 Q. The person who owned that company took that 

19 complaint, it was just one complaint? 

20 A. That's right. 

21 Q. Took that complaint seriously, right? 

22 A. Well, the complaint was entered into a CPSC, which 

23 is a Consumer Product Safety Commission database, and the 

24 way I understand this, their standard response is, to ask 

25 the manufacturer, explain this to us. And so that's 
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process. 

Q. Okay. And so they came to you and say, listen, I've 
got to reply back to CPSC and tell them what's going on? 
A. Well, so I had done a design review of this product 
initially and they came to me saying, what gives, how can 
this cause this. And so that was the flow of 
information. 

Q. And you came up with a potential cause? 

A Well, there was nothing in there because there was 

no radio transmitter, so. 

Q. Now, when you talk about real world, you understand, 
don't you, that computers -- and I think you said this 
earlier -- that computers in the real world, they freeze 
up, don't they? 

A. They can fail, yes. 

Q. And I think what you say -- and the reason they fail 
is because they have a bug in it, correct? 

A. Not necessarily. Sometimes you can have failures 
because someone has spilt something on it, for example, 
depending upon what type of computer it is. So I 
wouldn't say that bug is the only reasonable that 
computers can fail. 

Q. I understand. Would you give me that most of the 
time? 

A. I haven't done that analysis, so I can't even use 
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the word most. 

Q. When your computer fails, is it typically a bug? 

A I don't know what it is. I restart it and it works 
fine. I've never done the analysis. 

Q. So basically you turn it off, you turn it off, and 
then because it has something gets gone wrong with it, 
and then it comes back on and it works correctly, right? 
A. Most of the time. 

Q. And in fact, if you were to go in — if you were a 
computer engineer and you were to go in and say, I wonder 
why my computer turned off, if you were to go in, you 
wouldn't to be able to necessarily find what was wrong 
with it, correct? 

A. Well, so, that's not a good analogy because that 
computer may not be designed to track those failure. 
Sometimes they get -- we probably all seen the blue 
screen, and when the thing comes up I get a message 
saying memory overload. So the laptop in that case is 
actually designed to tell you there was a memory 
overload, so it depends on what type of failure it is 
that it's detecting. 

Q. That's fine. And we'll get to Toyota imbedded 
systems in just a second. But I'm just asking typically, 
if you went into that computer, you wouldn't necessarily 
find out what was wrong with the computer, what the bug 
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was, or why it shut down? 

A. Well, like I said, in my computer I've seen messages 
that pop up that talk about memory overload, so it 
depends on the situations. 

Q. You agree, don't you, that this particular imbedded 
system in this Toyota is a safety critical system, is 
that right? 

A. If you could define safety critical to me, that 
would be helpful. 

Q. Have you ever heard that term in imbedded systems as 
a safety critical system? 

A. Well, I have, and the reason I'm asking you to 
define it, is because it depends on the context. For 
example, if my watch has a battery in it and it's got a 

lithium ion battery, the imbedded system is a safety 

critical system because if the battery overheats or has a 
problem, then I get injured. That's why I'm asking you 
to define what a safety critical system is. 

Q. Well, on a car, what do you think a safety critical 

system is? I get to ask the questions. 

A. Well, I would say it's a system that if it fails 
should fail in a safe manner. 

Q. If it fails, it should fail in a safe manner. Is it 
-- is this imbedded computer in this Toyota Camry, is it 
a safety critical system? 
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A. Yes, it is. 

Q. If it is a safety critical system, which you say it 
is, it's vitally important, right, for that system to 
operate safely? 

A. Yes. 

Q. Otherwise people could die? 

A. Yes. 

Q. Or be injured? 

A. Yes. 

Q. If it's a safety critical system, would you agree 
that there should be no single point of failure, would 
you agree with that? 

A. I think I would not agree with that. 

Q. How many single points of failure permissible? 

A. Well, I think I would say that there shouldn't be a 

single point of failure that causes an unsafe condition. 
That's slightly different than there being no single 
point of failure. 

Q. So you're saying there can be a single point of 
failure, as long as it doesn't cause an unsafe condition? 
A. Yes. 

Q. So let me ask you this way. How many single points 
of failure are permissible if causes an unsafe condition? 
A. I don't know how to answer your question, because 
there should be no single point failure that causes an 
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1 unsafe condition. 

2 Q. Would that make the system defective? 

3 A. I don't know what you mean by defective, but if 

4 there is no single point of failure that causes an unsafe 

5 condition, then it's a safe system. 

6 Q. And I'm asking the reverse of that. If there is a 

7 single point of failure that causes an unsafe condition, 

8 does that make it defective? 

9 A. I guess it depends on what it unsafe condition is, 

10 so it would depend on how you define that. 

11 Q. Does it cause it to be unreasonably dangerous? 

12 A. Again, it depends, you know, if you have a single 

13 point of failure that's causing the radio to turn on, 

14 that's not something that causes it to be unreasonably 

15 dangerous, so it just depends on the context. That's why 

16 I'm having a tough time answering your question. 

17 Q. Do you agree -- do you agree that a system should 

18 have dual containment regions? 

19 A. I don't know what that means. 

20 Q. Okay. Fair enough. You're in the imbedded software 

21 industry and you don't know what that means? 

22 A I think what you meant to say was fault containment 

23 regions. 

24 Q. No, I meant to say dual containment regions. 

25 A. I don't know what that means. 
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1 Q. What if I add this for your benefit, dual fault 

2 containment regions? 

3 A. Could you repeat your question one more time, 

4 please, sir? 

5 Q. Do you know what a dual fault containment region is? 

6 A. Well, I've seen what Professor Koopman has described 

7 as a dual fault containment region, so yes. 

8 Q. You do know what that is? 

9 A. Yes. 

10 Q. Would you agree that your system, Toyota's system, 

11 should have dual fault containment regions? 

12 A. I don't agree with that. 

13 Q. You do not agree with that. And you're in the 

14 imbedded software industry, right? 

15 A. Yes, sir. 

16 Q. How many global variables are in this system? 

17 A. I didn't count them. 

18 Q. Did NASA count them? 

19 A. Yes, I believe they did. I believe there was a 

20 large number. 

21 Q. Would it be fair to say that somewhere between 

22 11,000 and 18,000 global variables? 

23 A. I didn't count them. If that's what NASA said, then 

24 yes. 

25 Q. Would you say that 11,000 to 18,000 global variables 
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in a system, is unsafe? 

A No. 

Q. You'd say that's okay? 

A. It depends on the system and the context and what 
the failsafes are. So you can't just take a number and 
do a subjective analysis to say if it's more than this 
it's unsafe. That's just not how it works. 

Q. All right. I was listening to you earlier and I 
thought I heard you say when you were going through your 
potential scenarios and why task X failure and why it 
doesn't matter, you talked about someone, if they just 
apply or tap the brakes then everything is cleared out, 
everything is reset, am I right? 

A. I don't believe I said that, no. 

Q. I'm sorry, I misunderstood you. What -- you tell me 
then, because I want to make sure I'm right, you tell me 
then, you were talking about task X dying and someone 
mashing the brake, am I right? 

A. I was talking about someone changing the software 
source code to artificially kill task X to stick the 
throttle at the last position. And if then someone 
tapped the brake, the brake switch transition would cut 
power to the throttle. 

Q. Okay. Is someone, the driver has to press a brake, 
is that one of the failsafes? 
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A. For that unrealistic condition that's what causes 
power to the throttle to be cut. 

Q. So is it fair to say that prior to that, before 
someone presses the brake pedal that there's a dangerous 
condition that is present? 

A. Again, I don't know how to answer that because I 
haven't done the analysis on just random scenarios. I 
focused on the analysis in this case and my opinions are 
based on this case. 

Q. And I think you told us that you did about 156 
tests, is that right? 

A. 150 odd tests, yes. 

Q. And is it fair to say that to test all the tasks for 
the death of the task or even the task X death, that you 
would have to do about over 16 million tests to test all 
the potential causes? 

A. No, that's not fair to say. 

Q. So if Mr. Barr said that, he would be incorrect? 

A. Yes, he would be. 

Q. All right. Now, do you agree that there were over 
80,000 coding violations? 

A. Coding violations to what, sir? 

Q. Well, in this case, do you specifically understand, 
and do you understand that there's a source code, right? 
A. Yes. 
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1 

Q. Are there violations in the source code? 

2 

A. Violations for what? 

3 

Q. In the — in the -- we talked about MISRA earlier. 

4 

right ? 

5 

A. Yes. 

6 

Q. And it doesn't sound like you were overly familiar 

7 

with MISRA, is that right? 

8 

A. I am familiar with MISRA. 

9 

Q. You went on the website and found out they were in 

10 

the UK? 

11 

A. Yeah, but I'm still familiar with it, yes. 

12 

Q. And are you familiar, and I think it's probably up 

13 

there, a big MISRA guidelines? 

14 

A. The coding rules, you mean? 

15 

Q. Yes . 

16 

A. Yes, I'm familiar with them. 

17 

Q. Are you gone through those? 

18 

A. I have, yes. 

19 

Q. Have you looked at those in terms of what's going on 

20 

in the Toyota system and whether Toyota met those 

21 

guidelines ? 

22 

A I did not, no. 

23 

Q. So you don't know whether there are 80,000 

24 

violations of the MISRA guidelines in the Toyota 

25 

operating system or not? 
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A. I think I've seen a report from Mr. Barr, I believe, 
that talked about the violations. I didn't do the 
analysis because the Toyota engineer had already told us 
that they were not following the MISRA coding guidelines. 
Q. What were they following? 

A They had there are own internal coding guidelines. 

Q. Did you look at the coding guidelines? 

A. I did, yes. 

Q. Did you peer review them before they went about the 
system? 

A. I did not peer review them. 

Q. Did you look at them and you talk about them in your 
direct examination today? 

A. I did not, no. 

Q. Did you bring those with you? 

A. I don't have them here with me, no. 

Q. Are there bugs in their system? 

A. I don't know if there are bugs in their system. I 
haven't seen any bug that causes UA. 

Q. That wasn't my question. Are there bugs that get in 
their system? 

A. I don't know. 

Q. Well, in every operating system and every imbedded 
system, you're going to have bugs in your system, right? 
A. I'm sure there are, I just haven't gone looking for 
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1 random bugs. I have focused on looking for bugs that 

2 affect the throttle and cause UA. So if there are other 

3 bugs, there might be, I haven't just gone looking for 

4 that. 

5 Q. So you didn't — did Toyota give you a summary of 

6 what the bugs they found in their system was? 

7 A. No. 

8 Q. Do you think it's important that a reasonable 

9 manufacturer would go in and they would look and say, 

10 hey, we're going to get these bugs and we need to address 

11 these bugs. Do you think that's what a reasonable 

12 manufacturer would do? 

13 A. Yes, it is. And I believe Toyota does that. One of 

14 the engineers Ishii had actually testified that when they 

15 run their coding standard through their source code, when 

16 they have any deviations they do a design review process, 

17 so I believe they do a process like this. 

18 Q. Have you seen those documents? 

19 A. I have not seen the documents. 

20 Q. I mean, they've never been produced in case? 

21 A. I think it's important to remember what a coding 

22 standard is and why it's not that important for my 

23 analysis. 

24 The way I think about a coding standard, and we have 

25 the MISRA guidelines, it's important to remember that 
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MISRA was never a standard and is still not a standard. 

A coding guideline is just telling you what not to do 
when you write code. And if you actually study the 
guidelines, one of the guidelines says, when you make a 
comment in the code, make sure you start each comment 
with a back slash character. If you don't start the 
comment with a back slash character, it's going to be a 
coding violation. It's got nothing top do with the code. 

Another MISRA rule says when you are doing your 
documentation, when you are doing your review, make sure 
it's peer reviewed. I'm sure it's peer reviewed, but 
even if it's not, if a code system on not peer reviewed 
it doesn't make it something that's a problem, because 
all these coding standards do is they help you write code 
that's easier to read. 

The analogy that comes to mind is, when you write 
sentences in English, when you put a period, you 
typically put two spaces after the period before you 
start the next sentence, so it's easier to read. When 
you start a new paragraph, you have a space between the 
paragraphs so it's easier to read. 

I may not want to put a paragraph -- a space between 
the paragraphs; you may want to put one. You use a 
different coding standard than I do. That doesn't mean 
your code is worse than mine. I think we know that Mr. 
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1 Barr has published his own coding standard. So now if I 

2 follow his coding, I don't follow MISRA and I don't 

3 follow the Toyota standard. That doesn't mean my 

4 software has bugs, it just means instead of spelling tire 

5 as in T-I-R-E, I use the British language to spell tyre, 

6 as in T-Y-R-E. 

7 So if I have a book that has the tire word written 

8 50,000 times, and if I do a spell check, my spell check 

9 will say you have 50,000 violations. So I just by saying 

10 that you have these 80,000 violations, or you have these 

11 coding standards, I didn't follow MISRA, it's meaningless 

12 for the analysis. 

13 MR. PORTIS: Your Honor, I just asked him 

14 whether or not Toyota had bugs, kept up with a bugs and I 

15 got a long answer, could I have a little instruction? 

16 THE COURT: I think he went overboard on that 

17 answer to be quite honest. Just listen real closely to 

18 what he's asking you. Your attorney will have an 

19 opportunity to ask -- Toyota's attorney will have an 

20 opportunity to ask questions at the end. 

21 THE WITNESS: I'm sorry. 

22 Q. (BY MR. PORTIS) I guess to go back where we were, my 

23 question is, does Toyota keep up with the bugs in their 

24 system, have you seen that? 

25 A. I haven't actually seen the bugs, but if you -- I 
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1 have run these tools on my own system. When you run on 

2 other software source code, when you run the tool, which 

3 is just a rule checking like a spell check, you get a 

4 report produced. That's your bug database. So if they 

5 are using a tool, which I believe they are, they have to 

6 have a report produced, because that's what the output of 

7 the tool does. 

8 Q. And so that information you would think a 

9 responsible manufacturer would have a collection of the 

10 bugs that they found in their system, is that right? 

11 A. I don't know what their policies are for tracking, 

12 keeping these bugs. I know that vehicle was developed in 

13 2001-2002, so I don't know their policies are. I know 

14 the reports would have been generated. 

15 Q. And you think they have these reports, you just 

16 haven't seen them? 

17 A. I don't know if they have them or not. I know that 

18 if they used a tool, they would have been generated. 

19 Q. And you haven't seen them? 

20 A. I haven't seen them, yes. 

21 Q. And I haven't seen them. 

22 MR. BIBB: Can I approach about this? 

23 (THE FOLLOWING PROCEEDINGS WERE HAD AT THE BENCH 

24 OUTSIDE OF THE HEARING OF THE JURY.) 

25 MR. BIBB: He's now trying to suggest that some 
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1 sort of discovery issue in this case. This is the 

2 improper form to do that and he shouldn't even raise 

3 those suggestions. This is clearly proper and I object. 

4 MR. PORTIS: They told us in the answer that 

5 they didn't keep up with. That's what Mr. Ishii 

6 testified and that's why I asked him. 

7 MR. BIBB: But your suggestion is -- 

8 MR. PORTIS: I'm moving on. 

9 (THE FOLLOWING PROCEEDINGS WERE HAD WITHIN THE 

10 HEARING OF THE JURY AS FOLLOWS:) 

11 Q. (BY MR. PORTIS) You mentioned that Toyota had their 

12 own standards, right? 

13 A. They had their own coding guidelines, yes. 

14 Q. And did you know that even in Toyota's own standard 

15 that Toyota violated about a third of their own standards 

16 in this code? 

17 A. I've seen some reference to that. I don't know if 

18 it's a third, but I know that there are instances when 

19 they don't follow them. 

20 Q. Do you think that a responsible manufacturer would 

21 violate a third of their own coding standard? Do you 

22 think that's responsible? 

23 A. Again, I think if you -- I think it's something that 

24 can be done if the proper review process it following. 

25 Because one of the coding guidelines, for example, says 
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my character names, the longest word has to be 30 letters 
long, and if you're longer than that, then you violate 
the rule. But sometimes you may need to have a longer 
word to describe what something is doing. And then if 
they follow the proper design review process to make sure 
that that exception to the rule is okay, then I don't see 
why that's a problem. 

Q. You know who Mr. Kwana is, don't you? 

A I have seen his name come up in some documents. 

Q. He says that for every 30 violations, you will have 
one major bug. Is that right? 

A. I don't believe that's correct. 

Q. So Toyota's own internal guy is wrong? 

A. I don't know what the context he said that in, so 
I'm not able to comment on it. 

Q. And didn't Mr. Kwana also say that Toyota should 
have followed MISRA? 

A. I have not seen that, so I don't know. 

Q. You haven't read his testimony? 

A. I don't believe I have. I don't remember sitting 
here. 

Q. Do you think MISRA is a good standard, don't you? 

A. I don't know if it's a good standard or not. Each 
coding rule should be designed for a certain system for a 
certain application. For example, you know, if MISRA is 
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1 a good standard then we wouldn't need other standards. 

2 Mr. Barr has published his own coding standard. So it's 

3 difficult to answer a question on whether MISRA is a good 

4 standard. Depends on the application that I'm using. 

5 Q. Do you think a responsible manufacturer puts 

6 together spaghetti code? 

7 A. Again, it depends on the context in which you're 

8 talking about, so. 

9 Q. I'm just asking do you think a responsible 

10 manufacturer puts together a spaghetti code? 

11 A. Well, again, it depends on what you mean by 

12 spaghetti code what you're talking about. 

13 Q. What do you call spaghetti code? 

14 A. To me spaghetti code would be code where different 

15 variables are checking different variables, there are 

16 lots of different checks being performed, lots of bounds 

17 being checks, angles being checked. And so stuff not 

18 going from A to B, but stuff going from A, check B, check 

19 C, so something where lots of checks are being performed 

20 would be spaghetti code. 

21 Q. Would you advocate that? 

22 A Well, again, it depends on the application. If you 

23 have an application where you want to check all the 

24 variables, hey, I just changed the throttle angle to 15, 

25 did I do the right job? Hey, something else is telling 
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1 there's an error flagged, did I do the right job? So if 

2 you're doing all these checks and all these balance 

3 checks, then the code may start to look like it's 

4 spaghetti code. So it's a very subjective analysis, and 

5 you can't just have a rule of thumb. You need to have an 

6 analysis of the system to decide if it's good or bad. 

7 Q. Let me ask it this way. Would you advocate 

8 spaghetti code in a safety critical system? 

9 A. Again, it depends on the context, it depends on what 

10 we're doing there, so I can't quite answer your question. 

11 Q. Now, you agree that there is no mirroring on all the 

12 variables, is that right? 

13 A. I believe that all the critical variables that are 

14 not protected by failsafes are mirrored. 

15 Q. That wasn't my question. You agree there is no 

16 mirroring on all of the variables? 

17 A. Yes. 

18 Q. There's no mirroring in the monitor CPU, correct? 

19 A. I know they use EDAC for some of the memory, so I 

20 don't know why you say there's no mirroring, because I 

21 believe there's some mirroring. 

22 Q. You said they use what? 

23 A. They use EDAC for some of the monitor CPU. 

24 Q. What is EDAC? 

25 A. It's error detection and correction. 
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1 

Q. Is there any EDAC for hardware bit flips? 

2 

A. Is there any hardware bit flips? I don't understand 

3 

the question. 

4 

Q. Are there EDAC for hardware bit flips? 

5 

A. Where, sir? 

6 

Q. Do you know what hardware is? 

7 

A. Yes, which part of the hardware. 

8 

Q. Huh? 

9 

A. I didn't understand the question, I'm sorry. 

10 

Q. On this -- in the Camry we talked about we've got a 

11 

computer in there, right? 

12 

A. Yes. 

13 

Q. Is there EDAC on the hardware bit flips? 

14 

A. Sir, the question doesn't quite make sense, because 

15 

you have EDAC from memory. Are you asking me if there's 

16 

EDAC in memory, is that the question? 

17 

Q. No. I'm asking you if there's a hardware bit flip. 

18 

is there EDAC that's mirroring to say, hey, listen, we've 

19 

got bit flip in this hardware? 

20 

A. Again, sir, the question doesn't make sense because 

21 

EDAC and mirroring are apples and oranges. 

22 

Q. All right. I don't want to get too far off. What 

23 

about, no design review on the monitor CPU, do you 

24 

advocate that? 

25 

A. Design review by whom, by Toyota? 
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Q. By Toyota? 

A. i don't know if they have done a design review or 
not, so I don't know. 

Q. Assume they haven't, do you advocate that? 

A. Well, if they've done some validation testing and if 
it meets their specs, that might be their way of doing 
design reviews. I don't know how to answer your 
question. 

Q. You didn't look into that? 

A. I did not, no. 

Q. All right. Now, you did some testing in this case, 
am I right? 

A. Yes. 

Q. The testing you did was 45 miles per hour, correct? 
A. I did a lot of testing. The task death testing, 
which was where we killed the task as done at 45 and 70 

miles per hour, but there was a lot of other tests that 

were done too, so if you can be a little more specific. 

Q. Did you do testing -- did some of your testing at 45 
miles per hour? 

A. Yes. 

Q. Did you apply 60 pounds of brake pedal force? 

A. I believe so, yes. 

Q. And were you able to stop the vehicle in 100 feet or 
less ? 
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1 A. That's what the data says. Sitting here I don't 

2 remember, but that sounds about right. 

3 Q. As a scientist at Exponent, would that surprise you? 

4 A. Well, in our testing, it's important to remember 

5 what we were doing. We were not applying the brake — a 

6 driver was not applying the brake in that testing. We 

7 actually had a pneumatic valve, we had an automated 

8 system. Because the reason I was doing that testing was 

9 to see if killing task changes the braking distance. So 

10 what we would do is we would go around the track, we 

11 would get the speed, and then an optical sensor would 

12 automatically trigger this big piston that would click on 

13 the brakes. 

14 And so we were doing testing with artificial brake 

15 force. There wasn't a driver pressing the brake. 

16 Q. Exhibit 7237. Is that the car you were testing? 

17 A. That's the 2005 Camry, yes. 

18 Q. And there's no one in -- there is no one in the 

19 Camry? 

20 A. No, there's three people in there. Actually, 

21 there's four people in there. 

22 Q. Very good. So there's four people in there and does 

23 someone apply the brakes? 

24 A. No, the brake applied by the hydraulic system. 

25 Someone can push the accelerator pedal, but he does not 
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1 apply the brake. 

2 Q. And you all monitor how much the brake is applied? 

3 A. We had a load cell, what's called a load cell on it, 

4 and that's a pressure transducer, it just monitors the 

5 force applied. 

6 Q. In one of your tests you ran it at 45 miles per hour 

7 and you put 60 pounds of force on the brake, right? 

8 A Yes, but in most of the tests except two we actually 

9 killed the tasks artificially before we applied the 

10 brake. 

11 Q. That's fine. My question is, did it stop prior to 

12 100 feet? 

13 A. That sounds about right, yes. 

14 Q. And you know the skid mark in this case is 150 feet, 

15 right? 

16 A. I've heard that, yes, sir. 

17 Q. Did any of your test vehicles leave skid marks? 

18 A. You know, we weren't looking for it, so I can't say 

19 for sure. But we would have seen them if they left skid 

20 marks. That's the best I can answer. 

21 Q. Okay. Did look at our car? 

22 A. Ms. Bookout's vehicle? I did not. 

23 Q. If the batteries on the car had been disconnected 

24 before anyone inspected it, the DTCs, if any, are erased, 

25 am I right? 
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A. Yes. 

Q. What's DTC? 

A. Diagnostic trouble code. That is the error code 
that is stored in memory. 

Q. Did you know the battery had to be hooked up when 
Toyota inspected it? 

A I did not know that, no. 

MR. PORTIS: We're done. 

MR. BIBB: I can make it in six minutes. Your 
Honor. If? 

REDIRECT EXAMINATION 

BY MR. BIBB: 

Q. Mr. Arora, let me just go back through my notes here 
and pick my best five for the next couple of minutes 
here. 

You are aware from reading some of the Toyota 
depositions that Toyota conducted a lot of testing on 
vehicles before those vehicles are release for 
production? 

A. Yes, I am. 

Q. They do electrical testing on the vehicle, do they 
not ? 

A. They do. I've seen tens of engineering test 
standards, I've actually reviewed them, so I've seen 
those standards. 
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Q. So whatever Mr. Lentz said, before this vehicle was 
released for production in -- beginning in 2002 with that 
generation Camry, it had been in developmental testing 
for quite sometime, correct? 

A. Yes. 

Q. And they do testing for electromagnetic 
compatibility, among other things? 

A They have several standards for electromagnetic 
compatibility, yes. 

Q. And they have standards to ensure that the vehicles 
are not affected by heat and cold? 

A. Yes, they do. 

Q. And salt water? 

A. Yes. I've actually seen a rain exposure test as 
well somewhere. 

Q. Rain exposure. Anything that could affect the 
electrical or electronic systems is the car is tested, 
correct ? 

A. Yes. 

Q. Let me go back to that last item you were talking 
about with testing that you did. You were killing these 
tasks, correct? 

A. Yes, this vehicle had the modified source code that 
we were talking about and we were artificially killing 
these tasks. 
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1 Q. And you were killing the tasks, if I understood it 

2 from reading your deposition, to see if when the task 

3 died whether it would have an effect on the stopping 

4 distance of the vehicle? 

5 A. Yes. So what we did was we ran a test with a 

6 vehicle without killing the task, we found out what the 

7 stopping distance was, and then we killed the tasks 

8 individually and in combination to characterize to see if 

9 the distances changed. 

10 Q. And did the cars stop longer or shorter with the 

11 task being killed? 

12 A. In most instances it was actually quite a bit 

13 shorter. 

14 Q. And why is that? 

15 A. It's because when we killed these tasks, typically 

16 the engine got stalled so whereas in a normal vehicle you 

17 still have power to the engine, when you kill the task, 

18 when you stall the engine and you go into failsafe mode, 

19 you're actually decelerating by removing power as well, 

20 so that was additional braking. So as compared to no 

21 task killing, when we kill the task we stopped a bit 

22 sooner. 

23 Q. So if the task is dead you generally got a shorter 

24 stop? 

25 A. Generally, yes. 
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Q. Mr. Portis was asking you, and I think it's a 
question that arose from Dr. Koopman about the dual fault 
containment system or regions or areas or something like. 
Does this electronic throttle control system need a need 
dual fault containment region, such as Dr. Koopman talked 
about ? 

A. It does not. 

Q. Why not? 

A. Because the way the system is designed, any fault 
that you have will be detected preventing it from causing 
UA. Another thing is, like I was saying before, we have 
to look at the application. Dr. Koopman himself pointed 
to what he called an industry standard which he called 
EGAS. And he said EGAS is the way to go. This is the 
standard Toyota should have looked at. 

And if you actually study what EGAS is, it uses the 
same design that the Toyota system has. So we can't just 
focus on the fact that we don't have a dual fault 
containment region, we need to see if there's a fault 
that can exist and cause UA. And I haven't found any 
faults, the plaintiff's experts haven't found any faults, 
and I know NASA hasn't found any faults, so there's 
really nothing in this throttle control design that can 
cause this vehicle to take off. 

Q. I just happen to have a copy of the EGAS standard 
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1 with me. What page was that? 

2 A. I remember correctly, it was page 30. 

3 Q. 30? 

4 A. Yes, sir. 

5 Q. Is that the fault containment system that Dr. 

6 Koopman was talking about that Mr. Portis was asking you 

7 about? 

8 A. That's the one that he referred to in his report. 

9 And he said that this system was the industry accepted 

10 system, and had a dual fault containment system. But if 

11 you really look at this system, you have the same thing. 

12 You have the functional controller, which is our main 

13 processor, and you have a monitoring controller, which is 

14 our monitoring processor. 

15 The functional controller calculates the throttle, 

16 determines the throttle, and the monitoring controller 

17 just does the monitoring. The signal's coming into one 

18 processor just like they do in our system. So this is an 

19 exact replica of what the electric throttle control in 

20 Toyota looks like. 

21 So this doesn't have the dual fault containment 

22 region. And Dr. Koopman indicated this was the industry 

23 standard. 

24 Q. So is the Toyota electronic throttle control system 

25 industry standard in your opinion? 
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1 A. I believe each vehicle manufacturer has their own 

2 designs, I haven't study the other designs. Whatever is 

3 available suggests to me that Toyota's throttle control 

4 system is no different from what other the vehicles have. 

5 It's equally, if not better, as good as the other 

6 systems. 

7 Q. All right. I've got 30 seconds, Mr. Arora. Tell 

8 me, are there bugs in the electronic throttle control 

9 system that cause UA? 

10 A. Absolutely not. 

11 Q. And have you — has there ever been a test where a 

12 task has been killed such as been suggested by Mr. Barr, 

13 the plaintiffs in this case, where the failsafe has not 

14 put the vehicle into -- excuse me, where the failsafe 

15 systems have not put the vehicle into a failsafe? 

16 A. No. 

17 MR. BIBB: That's all I have. 

18 THE COURT: Ladies and gentlemen, if you'll 

19 hold tie for a just a moment, I want to talk to counsel 

20 and get an idea of scheduling before you all lease. 

21 (Short pause.) 

22 THE COURT: Ladies and gentlemen of the jury, 

23 the defendant will finish the presentation of their case 

24 tomorrow perhaps by early afternoon, and so the case will 

25 be submitted to you, I would say probably on Thursday 
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1 

morning because we're going to have to work on jury 

2 

instructions and take care of issues like that. So I 

3 

would think the case would be submitted to you no later 

4 

than Thursday morning. So if that gives you any idea. 

5 

then the matter is basically in your hands, it's just 

6 

however long you all need you will have. 

7 

All right. You all have a good evening. We will 

8 

see tomorrow morning at 9:00. Again, do not discuss the 

9 

case and do not form any opinions about the case. 

10 

(JURORS EXCUSED.) 

11 

THE COURT: Back on the record, outside the 

12 

presence of the jury. 

13 

MR. JENNINGS: Judge, these exhibits from the 

14 

Stopschinski testimony are the data traces that we talked 

15 

about earlier, and those are the ones that you indicated 

16 

you were inclined to admit. That's just data output, the 

17 

machine output for the testing. And then in addition to 

18 

that I would offer the videos. Exhibits 102 and 353 which 

19 

is a video output of that testing that accompanies those 

20 

data traces. That is the same -- those are the same 

21 

videos that were shown to the jury. 

22 

THE COURT: So do we want to mark as this as 

23 

189? 

24 

MR. JENNINGS: Yes, ma'am. 

25 

THE COURT: That was the number -- 
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MR. JENNINGS: Yes, ma'am, that would be 189. 
And then with respect to the other Exhibits I think I can 
cleanse them of any labels, anything of that sort that 
would be cause for concern. And I think some of these 
other things that are largely demonstrative in nature can 
be deleted. And so I would — if I could have until in 
the morning, I would offer those as 189.1, or some such 
thing. The same with respect to the Exhibits that you 
said you had reserved judgment on. And so I think I can 
cut this down and remove any labels. 

THE COURT: Which ones do you think? 

MR. JENNINGS: These. 

THE COURT: These are ones I had not reserved 
judgment, unless you can convince me otherwise, this 
stack -- we're on the same page. 

MR. JENNINGS: Any of the demonstrative things, 
of course, we can take out, but with respect to these, 
we've got photographs just the scene and of the vehicle. 

THE COURT: And I was going to allow those in 
subject to being react anything the plaintiff might 
object to. 

MR. JENNINGS: And that's what we'll do. 

THE COURT: Do you all want to say anything 
about 189, the engineering study, that was 102, and 353 
which are the actual corresponding tests, any objection 
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to it. These are the actual tests that were played. 

MR. ESDALE: I thought those were going to be 
treated like, kind of like reliable authority treatises 
or something. And again, we had talked about this, one 
of the reasons we didn't offer some of our PowerPoints is 
because we thought they were going to be treated as Court 
Exhibits. And the reason I saw this, I know Mr. Barr, I 
mean Mr. McCort used a couple of those videos in -- maybe 
not those specific ones in his presentation -- and it may 
be we want to supplement for context. 

THE COURT: And who used? 

MR. ESDALE: Mr. McCort used actually some of 
Mr. Stopschinski's videos. 

THE COURT: Right now what I'm going to do is 
admit Defendant's 189, and then I'm also going to 
introduce 102 and 353 and I can check tomorrow and see if 
there's something else you want to argue should come in. 

COURT RECESSED FOR THE EVENING. 
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